topic Re: Can non-root user execute /sbin/ioscan? in Operating System - HP-UX

Can non-root user execute /sbin/ioscan?

Jun Zhang_4 — Fri, 03 Oct 2003 14:14:33 GMT

I set that file 4777, an ordinary user still cannot execute the command. Please help.

Re: Can non-root user execute /sbin/ioscan?

Brian Bergstrand — Fri, 03 Oct 2003 14:19:09 GMT

You've just opened your system for a huge trojan.

If you must allow normal users (and I don't know why), then try 2555 perms and make sure the file is owned by root: chown root /sbin/ioscan.

You may also want to investigate using sudo as you can restrict which users can use it and you have an audit trail.

HTH.

Re: Can non-root user execute /sbin/ioscan?

Brian Bergstrand — Fri, 03 Oct 2003 14:22:34 GMT

Sorry, that should be 4555, not 2555. Just get rid of the write perms.

ioscan is owned by bin so change the owner to root as I suggested and your users will be able to run it.

HTH.

Re: Can non-root user execute /sbin/ioscan?

Sundar_7 — Fri, 03 Oct 2003 14:25:23 GMT

Hi,

sure non-root user can execute ioscan.. u dont have to modify the permission.

just use the -k option

$ ioscan -fnk

Without -k option ioscan tries to refresh the kernel with the status of the devices. With -k opton it just queries the kernl memory and displays.

Sundar

Re: Can non-root user execute /sbin/ioscan?

Mark Grant — Fri, 03 Oct 2003 14:25:53 GMT

Actually I believe 4555 is more likely to work as this will set the setuid bit whereas 2555 will set the guid bit (6555 for both). I think Brian has a good point when he says that you shouldn't really do this and sudo is a much better option.

Re: Can non-root user execute /sbin/ioscan?

Brian Bergstrand — Fri, 03 Oct 2003 14:35:06 GMT

Sundara's option is better than anything else. I completly forgot about that. With -k you don't have to change anything.

Re: Can non-root user execute /sbin/ioscan?

Steven E. Protter — Fri, 03 Oct 2003 14:54:44 GMT

No.

You get an error accessing /dev/config

If you open up permissions there you might as well just wipe the whole box out.

This is a HUGE security problem. ioscan is an admin tool. Anyone that uses it should be trusted with the root password.

SEP