topic Re: /sbin/shutdown and /sbin/init in Operating System - HP-UX

/sbin/shutdown and /sbin/init

Crystal_1 — Thu, 20 Jun 2002 12:18:09 GMT

Hi,

I just found that the permissions for the two files are -r-xr-xr-x.

Does it mean all people can shutdwon the system?

CRYSTAL

Re: /sbin/shutdown and /sbin/init

T G Manikandan — Thu, 20 Jun 2002 12:23:55 GMT

hello,
If you make an entry in the /etc/shutdown.allow file then the user can shutdown the system.

Now if you shutdown as normal user it will give a message

"Must be root to shutdown"

only super user root can shutdown

Thanks

Re: /sbin/shutdown and /sbin/init

Tim D Fulford — Thu, 20 Jun 2002 12:24:04 GMT

No

shutdown is controlled by shutdown.allow

I'm fairly sure init makes kernel calls which the average user is not allowed to do.

Tim

Re: /sbin/shutdown and /sbin/init

Pete Randall — Thu, 20 Jun 2002 12:24:17 GMT

Only if they are list in /etc/shutdown.allow

Pete

Re: /sbin/shutdown and /sbin/init

Stefan Farrelly — Thu, 20 Jun 2002 12:25:18 GMT

No. Shutdown does extra checking to ensure only a superuser can run it. Try it as a non root user and you will see.

The permissions on /sbin/shutdown should actually be 04555. You can verify this by doing;

swlist -a mode -l file|grep "/sbin/shutdown"

And it returns 04555 (at least on my 11.0 box it does).

/sbin/init should indeed be permission 0555.

Re: /sbin/shutdown and /sbin/init

PIYUSH D. PATEL — Thu, 20 Jun 2002 12:27:31 GMT

Hi,

See the owner and group of these files. Owner will be root and group will be sys. Hence all the users cannot execute.

If you make an entry in /etc/shutdown.allow then the users can shutdown the machine.

Piyush

Re: /sbin/shutdown and /sbin/init

Crystal_1 — Thu, 20 Jun 2002 12:28:56 GMT

Hey guys,

This setting is by default. I have checked several boxes, they are the same settings.

CRYSTAL

Re: /sbin/shutdown and /sbin/init

Crystal_1 — Thu, 20 Jun 2002 12:35:34 GMT

/sbin/shutdown has extra checking. How about init and reboot?

I did check /usr/sbin/swlist -a mode -l file | grep "/sbin/shutdown" and it is 04555.

Does a regular user can run reboot or init?

Re: /sbin/shutdown and /sbin/init

PIYUSH D. PATEL — Thu, 20 Jun 2002 12:52:46 GMT

Hi,

A regular user cannot execute init or reboot.

It will give an error - "Must be a Super-User"

Give an ls -al /sbin/init and see the owner and group for this file.

The owner of these files is root and the group is sys. So only the user root or any other users in the group sys can execute these commands.

Piyush

Re: /sbin/shutdown and /sbin/init

PIYUSH D. PATEL — Thu, 20 Jun 2002 13:00:54 GMT

Hi Crystal,

Even reboot will tell you " Permission denied" when executed by any other user except root.

If all the users will have the previledge to use the shutdown/init/reboot commands then we system admins may have a "TOUGH TIME" !!!

Piyush

Re: /sbin/shutdown and /sbin/init

Steven Sim Kok Leong — Wed, 07 Aug 2002 09:30:26 GMT

Hi,

If an abnormal channel of access to /sbin/shutdown is exploited, with the setuid bit set, the shutdown binary is exposed to potential buffer overflows even though none has been discovered yet (as far as I can recall i.e. I have not done a thorough search for buffer overflow vulnerabilities on the shutdown binary). Thus, the security principle of least privileges tells us that such risks should be mitigated where possible, which is dependent on whether the configuration without setuid bits set is supported by HP.

Hope this helps. Regards.

Steven Sim Kok Leong