user's can't issue ignite

[Ravi_8]

Hi, everybody

we wanted to automate the OS and application installation on all unix platforms. In HP-UX i have created ignite server and depots of all applications. Only the root user can issue the ignite command to start the installation, for other users it says:
You must have super-user permissions to use this tool.
I wanted all users to have execute permission on ignite, so that they can install OS and applications according to their environment without asking sys admin.

thanx in advance

[Pete Randall]

chmod?

Pete

[Pete Randall]

I'll take that back. At least on my system, it's already 666.

Pete

[Ravi_8]

Hi, pete

-r-xr-xr-x 1 bin bin 180224 Apr 21 2001 ignite

ignite has already execute permission by defalut to everyone

[Patrick Wallek]

If REALLY REALLY want to, I suppose you could run it as set-uid.

# chmod u+s whatever

I don't know for certain that this will work, but it's worth a shot.

[Pete Randall]

I don't know Ravi - the only thing I can think of is that HP, in their infinite wisdom, decided that Ignite was suitable for root users only.

Actually, to me, that makes sense. There is no way I would want Joe User out there deciding he didn't like something about his workstation's behavior and re-Igniting it.

Pete

[Ravi_8]

Hi, patrick

chmod u+s ignite

even now user can't initiate ignite

[Dietmar Konermann]

Ignte checks for the real uid... so this wrapper should work:

#include
main()
{
setresuid(0,0,0);
exit (system ("/opt/ignite/bin/ignite"));
}

# chown root:sys ...
# chmod 4555 ...


WARNING:
Don't expect any security from a system with whis thing installed. Don't say I didn't warn you. :)

Best regards...
Dietmar.

[Ravi_8]

Hi, dietmar

#chown root:sys ignite
doesn't work

[Dietmar Konermann]

You have to compile and chroot the wrapper! Sorry, thought that would be clear. Or what's the problem?

- save proggi as iux-suid.c
- compile it
cc -o iux-suid iux-suid.c
- chmod 4555 iux-suid
- chown root:sys iux-suid

Then run iux-suid as non-root.

[Ravi_8]

Hi Dietmar

pls can you be more clear, i am not understanding proggi. file ignite says it's only executable

[Pete Randall]

proggi=program

[Dietmar Konermann · Accepted solution]

Hi Ravi,

simply take the source code, compile it and change its permissions/ownership. It's a wrapper... that means it a program (little program == proggie) that can be called by your users and which itself calls the original ignite program.

The trick is, it tweaks Ignite by calling the system call setresuid() before.

Hope, it's clear now.

Dietmar.

[Jochen Heuer]

Create file iux-suid.c with the following content:

#include
main()
{
setresuid(0,0,0);
exit (system ("/opt/ignite/bin/ignite"));
}

Then you have to compile the file:

$ cc -o iux-suid iux-suid.c
$ chown root:sys iux-suid
$ chmod 4555 iux-suid

This wrapper (iux-suid) switches the user-id to root and then starts ignite. So you can change the permissions of /opt/ignite/bin/ignite back to it's original values. Then you have to run

$ iux-suid

to start ignite.

Jochen

[Jeff Schussele]

Hi Ravi,

I don't know about this....
I guess I don't like to live *that* dangerously. If they're that capable - that they know how to properly use Ignite - they might as well be SAs.

My $0.02,
Jeff

[Ravi_8]

Hi,

users doesn't call any program in my case.
users just login to ignite server using their id's and execute ignite. it should yield the result.
It's working well in AIX (NIM - network installation management). I don't the problem with HP.

[Ravi_8]

Hi Dietmar/ Jochen

Thanx a lot, wrapper did the job