IDS Forum

Re: informix not creating files with req permi....

Posted By: Fernando Nunes
Date: Tuesday, 12 August 2008, at 7:19 p.m.

In Response To: Re: informix not creating files with req permissio (Jonathan Leffler)

Not sure if I agree (and I always think a lot before disagreeing with
Jonathan ;) ).
Who owns these files? User and group?
Remember that Informix is fully capable of doing role separation and if you
think seriously about doing audit logs you should have a special group for
it.
And user informix should not belong to this group
Last time I checked, the files were owned by the group defined as AAO
(Auditing analysis officer). And the members of these groups should be able
to delete the files.
We can question why the files are owned by user Informix, but with the right
directory permissions and assuming you don't put user Informix in the AAO
group user informix should not be able to access/alter/erase them.

So, 660 informix:aao should be ok.
The audit logs directory should not be owned by user Informix, should be
owned by group aao and cshould have permissions like 770.
The owner of this directory could be root or a member of aao group.

All this only makes sense with role separation, and I believe auditing only
makes sense with role separation.
I have some doubts about the directory owner (if it works with another owner
than Informix), but it should work in recent versions. If it fails to create
the files you may have to setup an env variable called NONROOT_OFF.

I have expressed most of my ideas about this here:

http://informix-technology.blogspot.com/2008/02/compliance-role-separation-and-audit.html
and
http://informix-technology.blogspot.com/2008/07/compliance-role-separation-and-audit.html

Regards.

On Tue, Aug 12, 2008 at 6:23 PM, Jonathan Leffler
<jleffler.iiug@gmail.com>wrote:

> On Tue, Aug 12, 2008 at 7:13 AM, VINU KURIAN <vinu.kurian26@gmail.com>
> wrote:
> > We have an executable running with group as database. When an expected
> event
> > occurs, onaudit is called to enable auditing and set the level of
> auditing
> to
> > be performed. Through onaudit, we are generating informix audit logs
> under a
> > folder called informixauditlogs. The folder has been created with 775
> > permission. And our assumption is that onaudit would create files having
> the
> > same permission as parent folder i.e., informixauditlogs. But to our
> surprise,
> > informix is creating those log files with a permission of 660.
> >
> > Can any of you please let me know why this happens. Is there a way to
> come
> out
> > of it?
>
> Audit logs are not executable, so they should never have the execute bits
> set.
>
> Audit logs are security sensitive. They should not be publicly
> readable. Otherwise, the general public could find out all sorts of
> interesting things that they should not be able to find out.
>
> I'd have considerable sympathy with a complaint to the effect that the
> permissions should be just 400 -- 660 is way too permissive.
>
> --
> Jonathan Leffler #include <disclaimer.h>
> Email: jleffler@earthlink.net, jleffler@us.ibm.com
> Guardian of DBD::Informix v2008.0513 -- http://dbi.perl.org/
> "Blessed are we who can laugh at ourselves, for we shall never cease
> to be amused."
> NB: Please do not use this email for correspondence.
> I don't necessarily read it every week, even.
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--
--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

Messages In This Thread

• informix not creating files with req permissions
  VINU KURIAN -- Tuesday, 12 August 2008, at 10:13 a.m.
  • Re: informix not creating files with req permissio
    Art Kagel -- Tuesday, 12 August 2008, at 11:21 a.m.
  • Re: informix not creating files with req permissio
    Jonathan Leffler -- Tuesday, 12 August 2008, at 1:23 p.m.
    • Re: informix not creating files with req permi....
      Fernando Nunes -- Tuesday, 12 August 2008, at 7:19 p.m.
      • Re: informix not creating files with req permi....
        VINU KURIAN -- Thursday, 14 August 2008, at 3:30 a.m.
      • Re: informix not creating files with req permi....
        Jonathan Leffler -- Sunday, 17 August 2008, at 6:47 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.