Re: KSH setuid script doesn't work?

In article <4dh37i$pj@cssun.mathcs.emory.edu>, David Sandman <sandman@cfer.com> wrote: >> In article <4dei14$i2b@ns.oar.net>, >> William Harris <william@carsinfo.com> wrote: >> > >> >I may be describing it in reverse of what actually happens, but the >> result is >> >that setting the suid bit on a script or program is not sufficient >> to get a >> >script to run as that user. > >Do you have a #!/bin/ksh (or whatever your favorite shell is) as the first line? >If you do then that will cause the shell to spawn another shell to actually run >the shell script. To prevent this from happening you can take out the >#!/bin/ksh, if your shell is the same shell that you created the shell script >for. Otherwise you need to create an executable that has the setuid bit set and have that call the shell script. This may vary from system to system, but I don't think your descripton is quite right. The shell from which you called the script forks a new process, but only one. The kernel then looks at the first line of the script to determine what shell to use, and exec's that shell. If the first line begins with anything other than #, the Bourne shell is typically used by default. If the first line begins with #, the C shell is typically used. If the first line begins with #!, the kernel reads the rest of the line for the pathname of the shell to use, along with any command-line arguments for that shell. You should be able to set the setuid bit of the script to run as a particular user, but setting it to root or to informix is probably a very bad idea for security reasons. -r