java process run as root (setuid bit) causes /usr/lib/dld.sl: Can't open shared library:...libjvm.sl

[Antonio Cardoso_1]

Hi,
I've just installed goldbase11i v0412 on a server, and noticed that I can't start some java process now, which was working fine before.
This process is started by a shell script with setuid permission to root (because it needs to listen to port 162):
-rwsr-xr-x 1 root sys 2760 Apr 22 11:49 /tmp/startproc

The script contents is :
#!/bin/sh
/opt/java1.4/jre/bin/java -classpath

- When I run this script logged as root, it's OK
- When I run it logged as another user, it now causes error:
/usr/lib/dld.sl: Can't open shared library: /CLO/Components/JAVA_12/Src/build/HP_UX/lib/PA_RISC2.0/server/libjvm.sl
/usr/lib/dld.sl: No such file or directory

Java release is 1.4.2_04

This behavior is new...
If anyone can explain me the reason of this (and maybe some way to cope with it)...

thanks.

[Stephen Keane]

Add

SHLIB_PATH=$SHLIB_PATH:"/CLO/Components/JAVA_12/Src/build/HP_UX/lib/PA_RISC2.0/server"
export SHLIB_PATH

to your script?

[Steven E. Protter]

The cause of the error is almost always the environment variable SHLIB_PATH

It neds to include the directory /usr/lib

export SHLIB_PATH=/usr/lib:$SHLIB_PATH

try again.

SEP

[Antonio Cardoso_1]

Hi

I changed nothing, and it is now working with original script.
Moreover, the SHLIB_PATH variable was never set before. I suppose that JAVA VM initializes the lib path according to architecture and VM-type.

I'll try once again after a clean installation.

Thanks for your answers.

[Antonio Cardoso_1]

now I rebooted my server, and the problem appears again:
- even after including
export SHLIB_PATH=/usr/lib:/opt/java1.4/jre/lib/PA_RISC2.0/server
in the script, it still causes the error.

I can run the process is logged root,
it fails if other user runs it.

Again, this was working before I installed the goldbase11i.0412 bundle.

[Stephen Keane]

Probably straying into grandmother's egg sucking strategies here, but what does

#ll /CLO/Components/JAVA_12/Src/build/HP_UX/lib/PA_RISC2.0/server/libjvm.sl

give you?

[Antonio Cardoso_1]

ll /CLO/Components/JAVA_12/Src/build/HP_UX/lib/PA_RISC2.0/server/libjvm.sl
gives nothing, which is normal because this is the path at development side.
This libjvm.sl should be resolved by to /opt/java1.4/jre/lib/PA_RISC2.0/server/libjvm.sl.

Note that I have more startup scripts that still work fine after install of goldbase11i.0412, and use a syntax similar to the one which fails.
The only difference is the setuid bit to allow programm running as root to be able to open socket on port 162.

[Stephen Keane]

If the script works OK if you log in and run it as root, but doesn't work OK if you run-as-root, that suggests maybe the environments are different? Maybe running env when logged in as root and putting env in the script would show up a difference?

[Antonio Cardoso_1]

I'm re-installing the machine in previous state, but I will try once again next week if have some time for it.
I'll keep you informed.

[Alex Glennie]

PHCO_27781:
( SR: [8606269172/STARS-ACTIVE/English] CR:JAGae33407 )
Applications that rely upon the ability of su(1) command to
switch to another user and pass along certain environment
variables, including but not limited to SHLIB_PATH, do not
work.

just a thought ?

[Antonio Cardoso_1]

Hi all,

having a look at J2SE SDK release notes, I found:
"Running Java with setuid or setgid
Java requires dynamic loading (SHLIB_PATH, LD_LIBRARY_PATH) which are disabled in setuid or setgid executables. Therefore Java cannot run with setuid or setgid."

=> I understand that having it working until now with the setuid bit was more an unexpected situation!!!

I have installed and configured sudo on my server as a way to replace the use of setuid.