topic Re: HPUX 11.31 same group but .. in Operating System - HP-UX

HPUX 11.31 same group but ..

Xavier BLANC — Wed, 21 Oct 2009 13:52:53 GMT

Hello ,
this ocure on my new itanium 11iV3.
I think this should be easy for you.
Two users same group ( users) :
- user1 create a file /tmp/file1
- user2 is unable to rename file ( mv file1 file2)
-file1 is rwxrwxrwx
-file1 is in /tmp
(drwxrwxrwt 11 root root 32768 21 oct 16:42 tmp )
this is quite anoying isn't it ?

I can remeber there was several levels of security but never use them .

may someone help me on this
please
xavier

Re: HPUX 11.31 same group but ..

Patrick Wallek — Wed, 21 Oct 2009 14:04:38 GMT

>>user2 is unable to rename file ( mv file1 file2)

What error does user 2 get?

Re: HPUX 11.31 same group but ..

Matti_Kurkela — Wed, 21 Oct 2009 14:17:00 GMT

The /tmp directory has the sticky bit (chmod +t) set.

The effect of the sticky bit is described as follows in "man 2 chmod":
----
If the mode bit S_ISVTX (sticky bit) is set on a directory, files inside the directory can be renamed or removed only by the owner of the file, the owner of the directory, or a process with the OWNER privilege (even if the modes of the directory would otherwise allow such an operation).
----

In other words, the sticky bit does exactly what it's documented to do.

The sticky bit is a basic filesystem feature: no special security levels are needed to use it. This has been possible to do from at least 11.00 onwards, but it has not been the factory default... until now.

Many programs can be abused by manipulating their temporary files. /tmp must be writeable by everyone, so the sticky bit (chmod 1777 /tmp) is recommended by security experts. Setting the sticky bit on /tmp and /var/tmp is either a default or a very common part of post-installation hardening procedures on many unix-style operating systems.

MK

Re: HPUX 11.31 same group but ..

Julián Aimar — Wed, 21 Oct 2009 14:19:12 GMT

Hi,

can you send error message and command output

# grep /etc/group

tks

Re: HPUX 11.31 same group but ..

Xavier BLANC — Wed, 21 Oct 2009 14:20:59 GMT

Ok,
thank's I didn't see the sticky bit.
Any idea on how I can remove sticky bit on /tmp,
I'm not affraid about security hole in that case.

Re: HPUX 11.31 same group but ..

Julián Aimar — Wed, 21 Oct 2009 14:24:44 GMT

Hi

chmod 777 /tmp

Slds

JEA

Re: HPUX 11.31 same group but ..

Patrick Wallek — Wed, 21 Oct 2009 14:25:37 GMT

>>Any idea on how I can remove sticky bit on /tmp

chmod o-t /tmp

or

chmod 777 /tmp

If you want to put the sticky bit back at some point:

chmod o+t /tmp

or

chmod 1777 /tmp

Re: HPUX 11.31 same group but ..

Xavier BLANC — Wed, 21 Oct 2009 14:29:15 GMT

Thank to all
so quickly

point assigned !
best regards

Re: HPUX 11.31 same group but ..

Xavier BLANC — Wed, 21 Oct 2009 14:30:23 GMT

With this quick help sticky bi was "fixed" :)
solved