System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

HPUX 11.31 same group but ..

SOLVED
Go to solution
Xavier BLANC
Frequent Advisor

HPUX 11.31 same group but ..

Hello ,
this ocure on my new itanium 11iV3.
I think this should be easy for you.
Two users same group ( users) :
- user1 create a file /tmp/file1
- user2 is unable to rename file ( mv file1 file2)
-file1 is rwxrwxrwx
-file1 is in /tmp
(drwxrwxrwt 11 root root 32768 21 oct 16:42 tmp )
this is quite anoying isn't it ?

I can remeber there was several levels of security but never use them .


may someone help me on this
please
xavier

8 REPLIES
Patrick Wallek
Honored Contributor
Solution

Re: HPUX 11.31 same group but ..

>>user2 is unable to rename file ( mv file1 file2)

What error does user 2 get?
Matti_Kurkela
Honored Contributor

Re: HPUX 11.31 same group but ..

The /tmp directory has the sticky bit (chmod +t) set.

The effect of the sticky bit is described as follows in "man 2 chmod":
----
If the mode bit S_ISVTX (sticky bit) is set on a directory, files inside the directory can be renamed or removed only by the owner of the file, the owner of the directory, or a process with the OWNER privilege (even if the modes of the directory would otherwise allow such an operation).
----

In other words, the sticky bit does exactly what it's documented to do.

The sticky bit is a basic filesystem feature: no special security levels are needed to use it. This has been possible to do from at least 11.00 onwards, but it has not been the factory default... until now.

Many programs can be abused by manipulating their temporary files. /tmp must be writeable by everyone, so the sticky bit (chmod 1777 /tmp) is recommended by security experts. Setting the sticky bit on /tmp and /var/tmp is either a default or a very common part of post-installation hardening procedures on many unix-style operating systems.

MK
MK
Julián Aimar
Frequent Advisor

Re: HPUX 11.31 same group but ..

Hi,

can you send error message and command output

# grep /etc/group

tks
Xavier BLANC
Frequent Advisor

Re: HPUX 11.31 same group but ..

Ok,
thank's I didn't see the sticky bit.
Any idea on how I can remove sticky bit on /tmp,
I'm not affraid about security hole in that case.
Julián Aimar
Frequent Advisor

Re: HPUX 11.31 same group but ..

Hi

chmod 777 /tmp

Slds


JEA
Patrick Wallek
Honored Contributor

Re: HPUX 11.31 same group but ..

>>Any idea on how I can remove sticky bit on /tmp

chmod o-t /tmp

or

chmod 777 /tmp

If you want to put the sticky bit back at some point:

chmod o+t /tmp

or

chmod 1777 /tmp
Xavier BLANC
Frequent Advisor

Re: HPUX 11.31 same group but ..

Thank to all
so quickly

point assigned !
best regards
Xavier BLANC
Frequent Advisor

Re: HPUX 11.31 same group but ..

With this quick help sticky bi was "fixed" :)
solved