ADSM-L

Re: dsmc sched as another user

2002-05-16 11:34:09
Subject: Re: dsmc sched as another user
From: Thomas Denier <Thomas.Denier AT MAIL.TJU DOT EDU>
Date: Thu, 16 May 2002 11:34:01 -0400
> Try using sudo.
> You can allow your non-root user execute only the dsmc command as root.

I think this would allow the non-root user to execute dsmc as root with
any operands, not just the 'sched' operand. This would be a serious
security exposure. The non-root user could replace any file on the system
with a copy of a different file or with an older version of the same file.
If the non-root user had root permission on any other Unix client system
the user could back up an arbitrary file there and restore it on the
system where he or she was a non-root user.

As far as I know, the only really safe way to do this is to write a
program specifically to start the scheduler and make that program
root owned, SUID, and executable by the user who needs to start the
scheduler. Many Unix systems even today have a bug that makes SUID
scripts dangerous. Unless you are certain that this bug is fixed on
your system you will need to write the program in C or some other
compiled language.
<Prev in Thread] Current Thread [Next in Thread>