topic Re: Giving a shell script root priv in Operating System - HP-UX

Giving a shell script root priv

Mike Burk — Wed, 12 Jun 2002 16:37:49 GMT

I have a shell script that uses the mount command. The script will be run by a regular user. How do I give it root privelages so mount will work?

Thanks,

Mike

Re: Giving a shell script root priv

Rodney Hills — Wed, 12 Jun 2002 16:42:57 GMT

It can be done, but not recommended. A tool called "sudo" allows a regular user controlled access to tasks you would set up.

You can find it on Software Porting and Archive Centre.

-- Rod Hills

Re: Giving a shell script root priv

Sanjay_6 — Wed, 12 Jun 2002 16:44:45 GMT

Hi Mike,

Use "sudo".

You can download and install sudo from this link,

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

Hope this helps.

Regds

Re: Giving a shell script root priv

Christopher McCray_1 — Wed, 12 Jun 2002 16:45:52 GMT

Hello,

I don't know your particular situation, but are you sure you want to attempt this?

Is it not possible to just run the script as root, on a regular basis in cron, for example?

You are talking about opening up permissions to system device files as well as mount points.

Just my two pennies.

Chris

Re: Giving a shell script root priv

Mark Vollmers — Wed, 12 Jun 2002 16:46:37 GMT

Mike-

You can script in the su command and have it pull the password from a file, but you have to be careful about security at that point. I think that there is a trick you can do to encrypt it, but I can't get on search to look for it.

Mark

Re: Giving a shell script root priv

Mike Burk — Wed, 12 Jun 2002 16:54:43 GMT

This is my scenario:

I have a network of 4 identical boxes. I have an application that runs on this network. I need to be able to mount to the other three boxes at runtime. If a one or more boxes are down I don't want to attempt to mount them. I tried to mount the boxes to each other at boot but if one or more boxes are down then it takes up to 20 minutes to complete the boot. This is not an option. My application runs from a regular user account. My script pings the other boxes and based on the results mounts the ones that are up.

If anyone has a better way to to this please help!

Re: Giving a shell script root priv

Rodney Hills — Wed, 12 Jun 2002 17:00:53 GMT

In /etc/exports, if you change "hard" to "soft" then it will not be so strict about the host being up.

Also you could look into "autofs" or "automount" as a way to have these services mounted on a as need basis.

-- Rod Hills

Re: Giving a shell script root priv

S.K. Chan — Wed, 12 Jun 2002 17:01:31 GMT

It sound like in the long run, implementing automount/autofs would be the way to go..

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B1031-90043/B1031-90043_top.html&con=/hpux/onlinedocs/B1031-90043/00/00/10-con.html&toc=/hpux/onlinedocs/B1031-90043/00/00/10-toc.html&searchterms=automount&queryid=20020612-110750

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B9106-90008/B9106-90008_top.html&con=/hpux/onlinedocs/B9106-90008/00/00/43-con.html&toc=/hpux/onlinedocs/B9106-90008/00/00/43-toc.html&searchterms=automount&queryid=20020612-110750

Re: Giving a shell script root priv

Mike Burk — Wed, 12 Jun 2002 17:02:38 GMT

I use soft mounts and it takes 20 minutes. Hard mounts cause the boot process to hang until it sees the server.

Mike

Re: Giving a shell script root priv

James R. Ferguson — Wed, 12 Jun 2002 17:28:29 GMT

Hi Mike:

There is a "dirty" way to achieve what you want, and I would be very careful of where, what and how you use it. It works in most cases. Establish your script as a 'setuid' script. Consider the script below. You must have the interpreter declaration as shown.

#/usr/bin/sh
/usr/sbin/mount /dev/vgXX/lvolY /mymountpoint
exit 0

Call the script 'mymount.sh' and do:

# chown root:dba mymount.sh
# chmod 4110 mymount.sh

Now, members of the group *dba* can execute the script, but only 'root' can read or write (modify) the it.

To further secure this script, place it in a directory whose sticky bit is set. This prevents non-owner's (here, root) from deleting it.

Regards!

...JRF...