setgid program using SHLIB_PATH on HPUX 11.22

[Stuart Jarriel]

dld.so appears to not honor SHLIB_PATH when
a program is set[ug]id on HPUX 11.22. Im
guessing this is to close a hole where a
library could be inserted to get priv escalation. However I cannot find any way to
add libraries to the 'TCB' (ala ldconfig on
Solaris). How should a setgid program that
uses (and provides shared libraries) be linked
to work on 11.22?

[Anil C. Sedha]

Stuart,

Add the path to your dld.so in /etc/profile on the system.

Also if you are using NIS and have a master user profile which propogates to the users, make sure that you add the path to it too.

For testing you may try this

export SHLIB_PATH=$$SHLIB_PATH:/test/test/dld.so

test is the path where dld.so lies.

Regards,
Anil

[David Storrie]

I would suggest first running a 'chatr' on the program to ensure it is using the SHLIB_PATH. If it is not enabled, then you're missing a "+s" from your linker options.

[Stuart Jarriel]

The program works (as a non-root user) when
its permissions are 555, But when I change
the permissions to 2555 (setgid) it can no
longer locate the shared libraries that are
present in SHLIB_PATH. SHLIB_PATH is set in
the environment of the calling shell.