topic Re: setgid program using SHLIB_PATH on HPUX 11.22 in Operating System - HP-UX

setgid program using SHLIB_PATH on HPUX 11.22

Stuart Jarriel — Wed, 23 Oct 2002 20:11:07 GMT

dld.so appears to not honor SHLIB_PATH when
a program is set[ug]id on HPUX 11.22. Im
guessing this is to close a hole where a
library could be inserted to get priv escalation. However I cannot find any way to
add libraries to the 'TCB' (ala ldconfig on
Solaris). How should a setgid program that
uses (and provides shared libraries) be linked
to work on 11.22?

Re: setgid program using SHLIB_PATH on HPUX 11.22

Anil C. Sedha — Wed, 23 Oct 2002 20:16:42 GMT

Stuart,

Add the path to your dld.so in /etc/profile on the system.

Also if you are using NIS and have a master user profile which propogates to the users, make sure that you add the path to it too.

For testing you may try this

export SHLIB_PATH=$$SHLIB_PATH:/test/test/dld.so

test is the path where dld.so lies.

Regards,
Anil

Re: setgid program using SHLIB_PATH on HPUX 11.22

David Storrie — Fri, 25 Oct 2002 11:56:11 GMT

I would suggest first running a 'chatr' on the program to ensure it is using the SHLIB_PATH. If it is not enabled, then you're missing a "+s" from your linker options.

Re: setgid program using SHLIB_PATH on HPUX 11.22

Stuart Jarriel — Fri, 25 Oct 2002 12:09:02 GMT

The program works (as a non-root user) when
its permissions are 555, But when I change
the permissions to 2555 (setgid) it can no
longer locate the shared libraries that are
present in SHLIB_PATH. SHLIB_PATH is set in
the environment of the calling shell.