topic Re: Assign root privileges to an other user in Operating System - HP-UX

Assign root privileges to an other user

Sergio Tancredi — Fri, 13 Apr 2001 10:07:14 GMT

Hi,
I need to assign the permission of execution of one shell script to an only user (beyond root).
The owner of this shell script is root.
This script executes various commands (It kills processes of which the owner is root, It changes the permissions to some files of which he is not owner, etc...).
I've tried with the command 'chmod +s myscript' but it has not worked.
Some errors:
chmod: Not owner
kill: PID: permission denied

Notes: I can't use "sudo" (It's not supported by HP)!!!

Thanks in advance,
Sergio

Re: Assign root privileges to an other user

Thierry Poels_1 — Fri, 13 Apr 2001 10:26:40 GMT

Hi,
chmod +s is only valid for executables.
You could indeed used sudo,
or you can write & compile a little C-script which simply executes your shell script, and then chmod +s the C-executable.
good luck,
Thierry.

Re: Assign root privileges to an other user

Steffi Jones_1 — Fri, 13 Apr 2001 12:35:42 GMT

Hello,

I can think of one other way, but sudo (even I think that sudo would do great because if gives you a monitoring feature as well).

Start restricted sam and set it up through sam.
Restricted sam is started with

#sam -r

Steffi Jones

Re: Assign root privileges to an other user

Kevin Wright — Fri, 13 Apr 2001 15:41:21 GMT

You need to be the owner of the file to do a chmod, if the file is owned by root, which I assume it is, then become root, and do a chmod 4755. this will set the SETUID bit, and whoever executes this command will cause it to run as if root ran it..just like the passwd command. make sure that nobody else can write to this file, and the script should work.
also chmod u+s file will work.

Re: Assign root privileges to an other user

Thierry Poels_1 — Fri, 13 Apr 2001 15:55:34 GMT

Kevin, Sergio is refering to a shell script. Shell scripts cannot have the sticky bit set.

Re: Assign root privileges to an other user

Piotr Bronisz — Fri, 13 Apr 2001 18:44:44 GMT

Hi,
I do not agree with Thierry Poels.
chmod +s is valid for scripts also.
You have to insert the first line:
#!/usr/bin/sh
and suid works.
Piotr

Re: Assign root privileges to an other user

Joseph A Benaiah_1 — Sun, 15 Apr 2001 23:31:04 GMT

I just thought that I would add my few pennies to this. In addition to ensuring that the suid is set i.e 4755, the script needs to be owned by root. This executes all commands with an euid of 0 when the script is run.

In general, suid scripts and programs do represent a security risk. I myself only use the root suid on programs written in C if absolutely necessary.

Cheers,

Joseph.

Re: Assign root privileges to an other user

Ed Ulfers — Tue, 17 Apr 2001 17:50:17 GMT

I have taken a slightly different approach to solving this problem in our environment, and this works:

Create a new group whose only member is this userid you want empowered. (Alternatively, I use the built-in group "adm" for administration purposes)

chown root:
chmod 4750
This allows members of this restricted group to execute the script which runs as root (from the sticky bit).

I use it for one of my applications that opens port and needs root ownership when running.

Hope this helps...
Ed Ulfers

Re: Assign root privileges to an other user

Sergio Tancredi — Wed, 18 Apr 2001 09:50:16 GMT

Hi All,

I have tried with sam -r but I would prefer that the user in issue assumes root privileges only during the execution of the shell-script.

The better thing could be the C-script.
Could you give me more details about this?

Thanks to everyone,
Sergio

Re: Assign root privileges to an other user

Manuel Plaza — Wed, 18 Apr 2001 10:07:56 GMT

Hi Sergio,

I am using sudo with HP-UX 10.20 and 11.0 and it's OK. I think that this is a very good solution.

Regards,

Manuel

Re: Assign root privileges to an other user

Shannon Petry — Wed, 18 Apr 2001 10:49:39 GMT

Well, other than C-Shell there is really no such thing as C-Script! C-Shell is not too much different than borne or korn shell!

What was being referred to is a C Program. It is relatively easy to use the system() in C to call a standard command. It gets a bit more complex to have this program and what it runs to run as root.

C executes very fast, and has the ability to control all aspects of the environment it is running in. You also have security in the fact that unless you give away your source code, noone can see what is going on. Unlike a script where a user has to have read access. A smart user could potentially use this to do lots of damage to your system!

If your not familiar with Unix C programming, then this will not be easy. If you have no C experience/knowlege at all, then your pretty much SOL cuz it will not be quick and dirty to learn.

Advice. Take C class, then Unix C programming. HP has some nice classes for this, as do lots of Universities.

If you need quick answers, then stick with the scripting for now and follow the advice of others. Or hire a consultant/developer to make the program for you.

Regards,
Shannon

Re: Assign root privileges to an other user

Thierry Poels_1 — Wed, 18 Apr 2001 11:23:03 GMT

okay, a little bit more detail :

create a file prog.c with following 4 lines:
main()
{
system("/your/dir/yourscript.sh");
}

then compile this little C-program:
cc prog.c

this results in an executable file a.out which you might want to rename to whatever ...
mv a.out whatever
chmod +x whatever # make it executable
chmod +s whatever # set sticky bit

Now let the user execute "whatever", and he will run "yourscript.sh" as root.
(and also award some points to the boys here ;)
good luck,
Thierry.

Re: Assign root privileges to an other user

Sergio Tancredi — Thu, 19 Apr 2001 07:46:31 GMT

Thanks to everyone for any help.
My problem is now resolved !!!
:-)))

Sergio