topic Re: user's can't issue ignite in Operating System - HP-UX

user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 13:59:43 GMT

Hi, everybody

we wanted to automate the OS and application installation on all unix platforms. In HP-UX i have created ignite server and depots of all applications. Only the root user can issue the ignite command to start the installation, for other users it says:
You must have super-user permissions to use this tool.
I wanted all users to have execute permission on ignite, so that they can install OS and applications according to their environment without asking sys admin.

thanx in advance

Re: user's can't issue ignite

Pete Randall — Wed, 19 Feb 2003 14:03:57 GMT

chmod?

Pete

Re: user's can't issue ignite

Pete Randall — Wed, 19 Feb 2003 14:06:17 GMT

I'll take that back. At least on my system, it's already 666.

Pete

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 14:07:32 GMT

Hi, pete

-r-xr-xr-x 1 bin bin 180224 Apr 21 2001 ignite

ignite has already execute permission by defalut to everyone

Re: user's can't issue ignite

Patrick Wallek — Wed, 19 Feb 2003 14:18:44 GMT

If REALLY REALLY want to, I suppose you could run it as set-uid.

# chmod u+s whatever

I don't know for certain that this will work, but it's worth a shot.

Re: user's can't issue ignite

Pete Randall — Wed, 19 Feb 2003 14:21:30 GMT

I don't know Ravi - the only thing I can think of is that HP, in their infinite wisdom, decided that Ignite was suitable for root users only.

Actually, to me, that makes sense. There is no way I would want Joe User out there deciding he didn't like something about his workstation's behavior and re-Igniting it.

Pete

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 14:29:27 GMT

Hi, patrick

chmod u+s ignite

even now user can't initiate ignite

Re: user's can't issue ignite

Dietmar Konermann — Wed, 19 Feb 2003 14:32:21 GMT

Ignte checks for the real uid... so this wrapper should work:

#include
main()
{
setresuid(0,0,0);
exit (system ("/opt/ignite/bin/ignite"));
}

# chown root:sys ...
# chmod 4555 ...

WARNING:
Don't expect any security from a system with whis thing installed. Don't say I didn't warn you. :)

Best regards...
Dietmar.

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 14:40:56 GMT

Hi, dietmar

#chown root:sys ignite
doesn't work

Re: user's can't issue ignite

Dietmar Konermann — Wed, 19 Feb 2003 14:46:14 GMT

You have to compile and chroot the wrapper! Sorry, thought that would be clear. Or what's the problem?

- save proggi as iux-suid.c
- compile it
cc -o iux-suid iux-suid.c
- chmod 4555 iux-suid
- chown root:sys iux-suid

Then run iux-suid as non-root.

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 15:00:42 GMT

Hi Dietmar

pls can you be more clear, i am not understanding proggi. file ignite says it's only executable

Re: user's can't issue ignite

Pete Randall — Wed, 19 Feb 2003 15:06:00 GMT

proggi=program

Re: user's can't issue ignite

Dietmar Konermann — Wed, 19 Feb 2003 15:08:22 GMT

Hi Ravi,

simply take the source code, compile it and change its permissions/ownership. It's a wrapper... that means it a program (little program == proggie) that can be called by your users and which itself calls the original ignite program.

The trick is, it tweaks Ignite by calling the system call setresuid() before.

Hope, it's clear now.

Dietmar.

Re: user's can't issue ignite

Jochen Heuer — Wed, 19 Feb 2003 15:15:24 GMT

Create file iux-suid.c with the following content:

#include
main()
{
setresuid(0,0,0);
exit (system ("/opt/ignite/bin/ignite"));
}

Then you have to compile the file:

$ cc -o iux-suid iux-suid.c
$ chown root:sys iux-suid
$ chmod 4555 iux-suid

This wrapper (iux-suid) switches the user-id to root and then starts ignite. So you can change the permissions of /opt/ignite/bin/ignite back to it's original values. Then you have to run

$ iux-suid

to start ignite.

Jochen

Re: user's can't issue ignite

Jeff Schussele — Wed, 19 Feb 2003 15:24:16 GMT

Hi Ravi,

I don't know about this....
I guess I don't like to live *that* dangerously. If they're that capable - that they know how to properly use Ignite - they might as well be SAs.

My $0.02,
Jeff

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 15:50:53 GMT

Hi,

users doesn't call any program in my case.
users just login to ignite server using their id's and execute ignite. it should yield the result.
It's working well in AIX (NIM - network installation management). I don't the problem with HP.

Re: user's can't issue ignite

Ravi_8 — Wed, 19 Feb 2003 16:04:39 GMT

Hi Dietmar/ Jochen

Thanx a lot, wrapper did the job