topic SUID SGID issue on execueting a exe in Operating System - HP-UX

SUID SGID issue on execueting a exe

Sunilsc — Mon, 28 Jul 2008 19:18:27 GMT

I have 2 exe one with 777 permision and other with 6755(set UID and GID).

The exe attributes are SHLIB_LIB lookup first and then embedded path.

When i execute the exe with 777 permission from a seperate login it finds all the linked libraries, while the same exe with SGID and SUID set, fails to find the libraries with SHLIB_PATH lookup enabled.

Below is a output of the behaviour explained above on HPUX 11iV2 Itanium Server.

hpitan4::/opt/plat1122/bin > ll fastunload*
-rwxrwxrwx 1 plat1122 dba 3551008 Dec 27 2007 fastunload*
-rwsr-sr-x 1 plat1122 dba 3551008 Jul 28 11:44 fastunload_test*

SHLIB_PATH is ENABLED BEFORE EMBEDDED PATH

chatr fastunload_test

fastunload_test:
64-bit ELF executable
shared library dynamic path search:
LD_LIBRARY_PATH enabled first
SHLIB_PATH enabled second
embedded path enabled third /home/CAI/manageit/support2/mgtdbt_dir/CSAPI/HPU112/toolkits/mitapi/r11.2.2/lib:/home/CAI
/manageit/support2/mgtdbt_dir/CSAPI/HPU112/toolkits/mitapi/r11.2.2/lib:/home/CAI/manageit/support2/mgtdbt_dir/CSAPI/HPU112/toolkits/dd_od
bc/v530/lib:/home/CAI/manageit/support2/mgtdbt_dir/CSAPI/HPU112/toolkits/rtworks/4.6.1/lib/ia64_hpux11:/usr/lib/hpux64:/opt/langtools/lib
/hpux64

Now when i run this exe from a different user other than its owner plat1122. I get error with the exe, which has SUID and SGID set and not from the same exe which has 777 permission.

hpitan4::/opt/plat1122/bin > ll fastunload_test
-rwsr-sr-x 1 plat1122 dba 3551008 Jul 28 11:44 fastunload_test*

hpitan4::/opt/plat1122/bin > ldd fastunload_test
Unable to find library 'libmitapi.so'.

WHILE On the EXE which has 777 permission i can execute it and it finds the dependant library.
hpitan4::/opt/plat1122/bin > ll fastunload
-rwxrwxrwx 1 plat1122 dba 3551008 Dec 27 2007 fastunload*

hpitan4::/opt/plat1122/bin > ldd fastunload | m
libmitapi.so => /opt/plat1122/UnicenterDCC/lib/libmitapi.so

Any idea why this behaviour is happening. On PA-RISC we had option to disable the embedded path but it is not available on Itanium Chatr options.

Re: SUID SGID issue on execueting a exe

Dennis Handly — Mon, 28 Jul 2008 21:06:40 GMT

SHLIB_LIB/LD_LIBRARY_PATH are ignored for setuid executables as a security risk.
To get this to work you must put those paths in /etc/dld.sl.conf:
http://docs.hp.com/en/B2355-60127/dld.sl.5.html#d0e978509

Re: SUID SGID issue on execueting a exe

Dennis Handly — Tue, 29 Jul 2008 18:38:07 GMT

If you are happy with your answers, please read the following about assigning points and reopening threads:
http://forums.itrc.hp.com/service/forums/helptips.do?#33
http://forums.itrc.hp.com/service/forums/helptips.do?#41

Re: SUID SGID issue on execueting a exe

Sunilsc — Tue, 29 Jul 2008 18:48:21 GMT

I had assigned 10 points to the case. I hope it is updated.

Thanks again,

Re: SUID SGID issue on execueting a exe

Dennis Handly — Wed, 30 Jul 2008 00:27:40 GMT

>I had assigned 10 points to the case.

You need to push the submit points button before the points are assigned.

Re: SUID SGID issue on execueting a exe

Sunilsc — Wed, 30 Jul 2008 13:48:16 GMT

I did the submit option, Thanks

Re: SUID SGID issue on execueting a exe

Dennis Handly — Thu, 31 Jul 2008 00:09:17 GMT

>I did the submit option

Hmm, still no points. Try reopening. Then use the points memu, then push the submit points.
Then close separately.

Re: SUID SGID issue on execueting a exe

Sunilsc — Thu, 31 Jul 2008 19:12:01 GMT

I did that and i can assign points now.

Sorry for the trouble, as this was my first post in the forum