<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
Just for my .02 - The setuid bit sets the effective userid of the user
calling the program to the user/group that owns the program. During the
course of execution the program can accomplish any task, good or evil,
that the owner can do.
For example, the example posted below by Joseph. The example shows the
program tmp.ksh is owned by 'oracle' and belongs to group 'dba'.
If the calling user can cause the script/program to core dump or quit
abnormally there used to be a very strong chance that the effective
userid of the calling user would still be 'oracle'. This showed up
years and years, (late 80's, early 90's), ago with the 'at' command in
some pre SysVR4 systems. If you could core dump the at command while it
was running, you were root.
Now, today, most programs and shells have specific signal handling code
for this, but, you have to treat the command as sensitive at minimum.
Joseph Amalraj wrote:
Security concerns ? Mark, please elaborate.
Interesting....I can confirm
that it works on Sparc-Solaris 9.
I thought suid shell scripts
were a thing of the past, due to security concerns. Seems they still
Mark J. Bobak
Senior Oracle Architect
ProQuest Information & Learning
"Exception: Some dividends
may be reported as qualified dividends but are not qualified
dividends. These include:
? Dividends you received on
any share of stock that you held for less than 61 days during the
121-day period that began 60 days before the ex-dividend date.&
nbsp; The ex-dividend date is the first date following the declaration
of a dividend on which the purchaser of a stock is not entitled to
receive the next dividend payment. When counting the number of days you
held the stock, include the day you disposed of the stock but not the
day you acquired it. See the examples below. Also, when counting the
number of days you held the stock, you cannot count certain days during
which your risk of loss was diminished. See Pub. 550 for more details.?
--IRS, Form 1040-A
Instruction Booklet, Line 9b: Qualified Dividends
Behalf Of Joseph Amalraj
Sent: Friday, February 17, 2006 5:04 PM
Subject: RE: Allowing users to execute shell scripts
without seeing password
I think this is plaform dependent.
On HP-UX i created a file under user "oracle" tmp.ksh
chmod 7711 tmp.ksh
ls -l tmp.ksh
-rws--s--x 1 oracle dba 20 Feb 17 16:51 tmp.ksh
From another user I ran
Fri Feb 17 16:57:06 EST 2006
Saving the file using "vi" resets the mode setuid bit.
So it has to be set again
This doesn't work in AIX
< I>Ken Naim
am probably not be reading enough into the question, but here are my 2
cents; just set permission to execute only with no read or write access.
On Behalf Of Radoulov, Dimitre
Sent: Friday, February 17, 2006 12:36 PM
Subject: Re: Allowing users to execute shell scripts without seeing
Got error, trying to resend ...
I've been trying to figure out a way that I can have my users allowed
to login to the server (HP-UX) with their own account and run a shell
script that's owned my me ...
but I don't want them to be able to see the password.
I had no luck just granting them execute on the shell script, t hey had
to have read priviledges in order to execute it apparently.
As suggested on comp.unix shell you can use shell script compiler.
You can try Francisco Javier Rosales Garcí¡¦#39;s shc: