execute acces on SYSUAF.DAT

[Bruno Seghers]

Hi,

I install a patch on a third party Scheduler product ($U from Orsyp). Since this moment, I have security problems on the SYSUAF.DAT file.
Users who runing task under the scheduler generate a protection error : they try to access the SYSUAF.DAT in execute mode.

My question is : what is the risk to give (w:E) protection on SYSUAF.DAT. In the VMS doc I only see that execute access is to authorize to run a image or to @ a dcl file.

Thanks for help

Seghers Bruno

[Wim Van den Wyngaert]

Hi Bruno,

Long time no see.

I have no knowledge of side effects except that you can @ the sysuaf file.
BTW : over here they are RE with no side effects.

CU

Wim

[Volker Halle]

Wim,

setting SYSUAF.DAT to WO:RE is an invitation to hackers to try and crack your passwords.

The default protection for SYSUAF.DAT would be: SYSTEM:RWED, OWNER:RWED and nothing else.

Volker.

[Wim Van den Wyngaert]

If you give W:R to the sysuaf, a user could do open/share=read/read and thus prevent other processes from updating it. This could cause hanging processes (password changes, update date last login, etc).

Wim

[Ian Miller.]

is the product asking for execute only or read and execute (the audit entry should tell you)?

[Bruno Seghers]

Execute only

[Wim Van den Wyngaert]

I tested it and with RE your system gets in hung after open/read/share=read.

In accounting : error accessing system authorization file and this for all new processes.

Wonder what other files I could use in this way ... should check *.dat at least.

Wim

[Ian Miller.]

The original question is about the risk of execute only access for world.

One way of restricting this risk would be to add an ACL with a ACE grating execute access to holders to a specific idenitifer. Then grant that identifier to users who need to run a task under the scheduler.

I think that the locking problem mentioned above needs read access.