topic Re: Non root users executing make_recovery in Operating System - HP-UX

Non root users executing make_recovery

Dan Ryan — Fri, 13 Oct 2000 20:50:05 GMT

I have an OPS staff that does not have root access that I want to create make_recovery tapes. I've given them a menu that invokes a script this is owned by root and has the set_uid bit set.
Script Permissions are 4750 Owner is root group is root.
The operator is a member of the root group and can execute the script.
The command in the script is :
/opt/ignite/bin/make_recovery -AvC -d /dev/rmt/5mn -b /tmp/uninstalf.recovery
Failure message are:
HP-UX System Recovery
nftw: Permission denied
make_recovery(338): Failed on /
make_recovery(346): failed on /
Validating append file
Done
make_recovery(228): make_recovery(1M) encountered a fatal error.
make_recovery(230): Please fix errors and re-try.
Cleanup

Looks like make_recovery programs are ignoring euid of the script. Any suggestions on how to make this work?

HP-UX 11.0 Ignite B.2.4.307

Thanks for your time & help.

Re: Non root users executing make_recovery

Alan Riggs — Fri, 13 Oct 2000 20:54:48 GMT

If the make_recovery subcomponents dig deeper than euid, you will probably have to use Sudo or something similar.

Re: Non root users executing make_recovery

Ian_4 — Fri, 13 Oct 2000 22:17:59 GMT

run du / to get the list of subdirs -clean unnecessary data under / and try again.

Re: Non root users executing make_recovery

Lawrence Mahan — Tue, 17 Oct 2000 17:13:09 GMT

I had the same problem. I hade to write a C routin that used the setuid and setgid funtion calls and then did a system call to run the needed scripts. The c routine has to be owned by root with the s bit set and the w bit removed for security.

Re: Non root users executing make_recovery

Rick Garland — Tue, 17 Oct 2000 17:20:55 GMT

sudo would be a good choice. In addition to running the make_recovery as root, you will get logging of the event, who did it, and when it was done.

The sudoers file can be setup to only allow the make_recovery and can be limited to a certain group of users. They can be setup to do nothing else as root except the make_recovery.