Sticky Bit "t“; which process could set it?

[arking1981]

Dear there,

This is happening on our cusomters' server. I don't know when this started but when our program began to have problem I got to notice that.  Our program fails because it has to delete some temp files under /var/tmp, and those files have sticky bit "t" set, so our program can't delete it becasue the users to create it and delete it are different. This is somehow our design but my question is why the sticky bit "t" was suddenly got to set? while before it didn't.

By "fuer /var/tmp" I can find some  snmp processes are using this directory, should any of them are setting sticky bit "t"??

    root 18859 1 0 Jul 5 ? 0:00 /usr/sbin/trapdestagt
    root 18865 1 0 Jul 5 ? 0:00 /usr/sbin/fddi4subagt
    root 18836 1 0 Jul 5 ? 0:13 /usr/sbin/mib2agt
    root 4833 928 1 15:03:07 pts/4 0:00 grep -E 18859|18865|18836|18811
    root 18811 1 0 Jul 5 ? 0:00 /usr/sbin/hp_unixagt

Please suggest. Thanks in advance.

Regards

Kang

[Dennis Handly]

Setting the sticky bit on tmp directories is a security measure, a good thing (TM).  So any program like bastille could be doing it.

Also, if the bit isn't set on /var/tmp/, you'll get a nasty message in syslog.log from ld or a compiler.

>SNMP processes are using this directory, should any of them be setting sticky bit?

Probably not.

[Bill Hassell]

There is nothing automatic in HP-UX to change the permission bits on /var/tmp. Perhaps some security expert has added a job to crontab to make sure the permissions are safe. If you change /var/tmp to 777 (no sticky bit) then everyone on your computer can remove or rename any files, and even create directories and subdirectories to hide your files. If these files are important, then /var/tmp is not the right place. There are many different ways to control the content of files as well as their existence (the permissions are separate and independent of each other).

[Dennis Handly]

>There is nothing automatic in HP-UX to change the permission bits on /var/tmp

Possibly someone doing "swverify -F" on filesets that mention /var/tmp/.

[arking1981]

Thanks everybody. 

Should swverify set this bit? I will try to find out

[Dennis Handly]

>Should swverify set this bit?

Only if you order it to do so with -F, on the right (or all) filesets.