Re: permissions

Tony Heskett writes (in response to my original email and Jonathan Leffler response): > > >(2) prevent the creator of a table/view from updating that table/view? > > > > No. The owner of a table may drop the table at any time. The owner of > > a table may do anything with that table. If you don't want someone > > fiddling with a table, they had better not own that table. >Ah-ha ! Sort-of - how about a setuid-wrapper (make it setuid to >informix, or a suitable DBA for your DB) that only runs one (or a >small selection of) command(s) ? > >Things to remember are > >a) shell scripts that are setuid are drastically insecure, > even if they're allowed on your machine. > >b) C-progs that need to run on a variety of Unix boxes tend > to need a selection from setuid, setgid, setresuid, setresgid ... > For a one-off, though, it should be dead easy. man setuid and > go from there. The problem with this is that (in att universe) setuid only sets the effective user id (unless root is running) and informix users the real user id. In ucb there is a setreuid to set the real userid; but unfortunately, we run in att. Thanks, Warren J. Saccente