topic Re: How to resrtict users from executing chown command? in Operating System - HP-UX

How to resrtict users from executing chown command?

Upul Edirisinghe — Wed, 21 Feb 2001 03:59:09 GMT

Re: How to resrtict users from executing chown command?

Steven Sim Kok Leong — Wed, 21 Feb 2001 06:38:32 GMT

Hi,

You can set ACL on the chown binary so that only userids in the ACL listing can execute the chown command.

ACL is available on HFS and JFS 3.3. man chacl on the syntax of setting it. Example:

# chacl '(abc.%,r-x)(def.%,r-x)' `which chown`

i.e. Only the users abc and def can execute the chown command.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

Re: How to resrtict users from executing chown command?

Marco Hernandez_1 — Tue, 06 Mar 2001 15:47:32 GMT

This could help:

chmod 700 /bin/chown

Or set up a new group then change the group owner to the new one, then add the new group to the users you want to restrict chown.

Marco

Re: How to resrtict users from executing chown command?

Deshpande Prashant — Tue, 06 Mar 2001 17:11:52 GMT

Hi
Change permission on /sbin/chown to 554. It will allow only root (members on bin group) to execute this command.
# chmod 554 /sbin/chown
# ls -l /sbin/chown
r-xr-xr-- 1 bin bin 200704 Nov 7 1997 /sbin/chown.

Thanks.
Prashant Deshpande.

Re: How to resrtict users from executing chown command?

Peggy Fong — Tue, 06 Mar 2001 18:01:04 GMT

Hi
CHOWN is a global privilege (see setprivgrp (1m)) test to be sure this is what you want.

# getprivgroup
global privilege: chown

# echo ?n > /etc/privgroup
# chmod 400 /etc/privgroup
To add CHOWN and other global comands for specific groups see the following example:

Example:
To add CHOWN and MLOCK for dba group or users.
echo dba CHOWN MLOCK >> /etc/privgroup

# sbin/init.d/set_prvgrp start

# getprivgrp
global privileges:
dba: MLOCK CHOWN

HTH
Peggy