topic Re: Execute bit without read on a script in Operating System - HP-UX

Execute bit without read on a script

Gary A. Price — Fri, 02 Jun 2000 20:32:02 GMT

I am trying to allow all the members of a group to execute a script (ksh) without having the read bit set. I thought it was possible to set the execute bit only at the group level allowing users to execute the script but restricting read access. When the users run the script they receive a message unable to open file. Anyone know if it is possible to do this or of any work arounds?

Thanks,

Re: Execute bit without read on a script

Alan Riggs — Fri, 02 Jun 2000 20:59:49 GMT

I do not believe that this s posible. The shell must be able to read the commands to parse the script, and the shell is owned by the user. If you want users to be able to "do the job" without "seeing the job" then you will probably need to write it in C and compile it.

Re: Execute bit without read on a script

Alvaro Fdez. Lago — Sat, 03 Jun 2000 08:13:50 GMT

Hi Gary,

Think about installing "sudo" for those tasks (http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.2b1)

This way, you can made the script executable only by root, and
(in the sudo's config file) define which logins or groups can
run it. Then, put an alias in each user's .kshrc/.profile:

alias myscript="/opt/sudo/bin/sudo /usr/local/bin/myscript"

You can configure sudo to restrict the users from running *any
other* binary or script on yout system, not even a shell,
apart those configured in the sudo's config file.

Read about sudo at http://www.courtesan.com/sudo

Regards,

Re: Execute bit without read on a script

Steven Sim Kok Leong — Sun, 04 Jun 2000 02:12:56 GMT

Hi,

Give restricted SAM or RSAM a try. It allows a predefined set of users to execute a script by selecting the corresponding item from a SAM menu. In this way, you can give your group of users execute privileges without allowing read or write access by the same group of users.

I have been using RSAM to give operators specific privileges to certain scripts for daily operations without giving them any read access into any of the script's internals.

Regards.

Steven Sim.