Limit access to glance

[Kevin Nikiforuk]

We are trying to limit access to glance on our machines to a smaller group of users. I created a group named glance, added the relevant users to it, changed the group ownership to the glance group and removed other execute permission. Suggestions?

[Steven E. Protter]

You have done what you need to do.

Removing other execute permissions will prevent users not in the same group as the glance owner form executing the program.

You're done. Time to test it. Never rely on untested changes.

If you get unexpected results, please post back the id command from the test user and the permissions on the glance executable.

SEP

[Kevin Nikiforuk]

I thought so, however it doesn't appear to be working on our 10.20 servers.

ll /opt/perf/bin/glance /opt/perf/bin/gpm
-r-sr-xr-- 1 root glance 538073 Oct 6 2000 /opt/perf/bin/glance
-r-sr-xr-- 1 root glance 1490183 Oct 6 2000 /opt/perf/bin/gpm

id
uid=5001(oraoper) gid=101(oradba)

grep glance /etc/group
glance::107:oraoper

[doug mielke]

Does the s in perms list set user to owner?

[Kevin Nikiforuk]

Sorry, I don't understand what you're asking. The suid bit is set if that's what you're asking...

[John Poff]

What error do you get when one of your glance users tries to run it on the 10.20 box?

JP

[Kevin Nikiforuk]

#/opt/perf/bin/glance
ksh: /opt/perf/bin/glance: cannot execute

[John Poff · Accepted solution]

Here is just a swag, but have you tried doing a 'newgrp glance' and then trying to run glance?

JP

[doug mielke]

My thought was that the sgid bit would have to be set as well for group access, but Iwas going down the wrong track.

[Kevin Nikiforuk]

We have a winner! If I run newgrp glance, then run glance, it works like a charm. It's a bit of a pain, but it's only on three boxes.

Thanks for your help!

[A. Clay Stephenson]

There is a even easier method that will not require running the newgrp command.

ln /etc/group /etc/logingroup

Now if a user is a member of multiple group, permissions will be checked automatically. Primary group membership is determined by the user's group id in the passwd entry.

[Kevin Nikiforuk]

Less work = even better! =) Thanks guys.