topic Re: suid bit in Operating System - HP-UX

suid bit

roger_101 — Wed, 03 Nov 2004 14:14:02 GMT

Why is the suid bit enabled for these programs? Would any user other than root need to run these?

/sbin/lvchange.run
/sbin/lvmerge
/sbin/lvsplit
/sbin/lvsync
/nomwcsyncd
/sbin/vgsync

Thanks

Re: suid bit

Sundar_7 — Wed, 03 Nov 2004 14:31:46 GMT

Hi Roger,

You can ignore the SETUID bit on these programs. The programs has internal checks to check for the real UID of the user executing the file even though SETUID has been set.

Infact, all the LVM commands are hard linked to the same binary - /sbin/lvchange. It is just the name of the file that differs. interesting.. isn't it ?

- Sundar

Re: suid bit

Alzhy — Wed, 03 Nov 2004 14:32:38 GMT

They need to (as most other system level commands) since they access, modify or update files that are protected and must be secured.

Re: suid bit

Sundar_7 — Wed, 03 Nov 2004 14:43:54 GMT

Just to make sure you are not mislead - even if the SUID bit is not set and if the root runs the program, the process created can bypass all the access permission settings.

I cannot tell you why SUID is set for the lv* commands, but I can tell you it is not a security risk since LVM commands checks the REAL UID of the user before executing the operation.

So , even if a non-root user executes lvlnboot, for example, the effective UID of the process will be 0 but REAL UID of the process will still be that of the user's UID and thus the user will not be allowed to continue.