Re: dbaccess Permissions

In article <3pt9fk$7bn@cssun.mathcs.emory.edu>, Cathy Kipp <ckipp@vth1.vth.colostate.edu> wrote: > >Problem: User A has been granted a wide variety of permissions to Informix > tables and databases because the user runs applications which > require these permissions. However, if User A were to become a > more advanced user, he/she could easily execute dbaccess [...] If I understand your problem correctly, it's one that many sites have that want to run a relatively closed menu-controlled application, yet offer access for ad hoc queries, etc., to the same database. Changing permissions on dbaccess might work in your case, but I don't think it's a good general solution that plugs all of the holes. What about people with access to the 4GL compiler? What about remote users in C/S environments? I think a better solution is to attack what is essentially an access privilege problem at that level. One approach is to start the menu-controlled application with a front-end or wrapper program that is setuid root. The start-up program changes the real and effective uid of the invoking user to something different. Some sites change to the same run-time uid regardless of invoking user, but we use a separate run-time uid that we generate based on the invoking user. For example, if "ckipp" runs the application, the start-up program would change the real & effective uid to that associated with the login-ID "xckipp". The DBA could then grant the privileges needed for the application to xckipp, and the more restrictive (e. g., only select) privileges to ckipp. There are of course a number of details to be handled in implementing this solution. You can find many of them in a paper I wrote for the first Informix user conference. Look for the file /pub/informix/pub/appstart in the ftp archive on mathcs.emory.edu. The archive is also mirrored on the system quasar.ucar.edu. The file also contains sample code and a Makefile. Good luck, Walt. -- Walt Hultgren Internet: walt@rmy.emory.edu (IP 128.140.8.1) Emory University UUCP: {...,gatech,rutgers,uunet}!emory!rmy!walt 954 Gatewood Road, NE BITNET: walt@EMORY Atlanta, GA 30329 USA Voice: +1 404 727 0648