Re: set-uid root files in bin/

Don't reset the SUID root permissions on sqlturbo -- you will get failures when the user's need to sort huge files because of ulimit problems. I do not know why OnLine needs mkdbsdir -- I think that could probably be eliminated altogether, but I don't know for sure. tbmonitor and tbspaces should be left SUID root. So should the sgidsh program -- it forcibly sets the correct real UID and GID values for a user when a stored procedure runs something with the SYSTEM statement. Those are all the SUID-root programs in the 5.03.UC1 OnLine files. Basically, you need them all to be SUID root. Informix has never gone in for the blunderbus approach to using SUID root privileges which some other software products have used. That which must be SUID root is; that which doesn't isn't. Yours, Jonathan Leffler (johnl@informix.com) #include <disclaimer.h> }From: ptp@fallschurch-acirs2.army.mil (Paul Pryor) }Date: Sun, 12 Feb 1995 10:11:36 -0500 (EST) }X-Informix-List-Id: <list.5545> } }I was building up an AT&T 3B2 OS release to be installed on all field }offices, and in the process I installed Informix Online. I do all kind }of stuff, such as stripping down (removing demo/, release/, postscript }files, etc), and changing file permissions for tighter security, and }so on. } }I then looked at Informix's bin/ set-uid and set-gid executables, and }wondered if they really need to be set-uid root, since they are also }set-gid informix. Running with id of informix alone should give access }to informix raw partition, and shared memory. I could experiment by }turning off set-uid root bits, and then running Informix through its }paces, but I do not have enough time to do a full test, to make sure }Online is still fully functional. I want to minimize number of set-uid }root files. Another interesting security issue is bin/sgidsh, whose name }implies that it will run scripts with root user id and informix group id, }since it is both set-uid root and set-gid informix. } }Release/Platform Information: } }Informix-SQL Runtime 4.11.UC1 Media No: 11204121-0011084 }Informix-4GL Runtime 4.11.UC2 Media No: 11205121-0011083 }Informix-Online Rumtime 5.00.UD1 Media No: 102-07051-001108-1 }AT&T Unix System V Release 3.2.3, Load 30, Upgrade 3 (Tape L) }AT&T 3B2/600G } }Many, and many thanks for any information, and discussion.