Join IIUG
 for   
 

Informix News
18 Nov 13 - ZDNet - Top 20 mobile skills in demand... Read
09 Sep 13 - telecompaper - Shaspa and Tatung have shown a new smart home platform at Ifa in Berlin. Powered by the IBM Informix software... Read
06 Sep 13 - IBM data magazine - Mission Accomplished - Miami, Florida will be the backdrop for the 2014 IIUG Informix Conference... Read
01 Feb 13 - IBM Data Magazine - Are your database backups safe? Lester Knutsen (IBM Champion) writes about database back up safety using "archecker"... Read
14 Nov 12 - IBM - IBM's Big Data For Smart Grid Goes Live In Texas... Read
3 Oct 12 - The Financial - IBM and TransWorks Collaborate to Help Louisiana-Pacific Corporation Achieve Supply Chain Efficiency... Read
28 Aug 12 - techCLOUD9 - Splunk kicks up a SaaS Storm... Read
10 Aug 12 - businessCLOUD9 - Is this the other half of Cloud monitoring?... Read
3 Aug 12 - IBM data management - Supercharging the data warehouse while keeping costs down IBM Informix Warehouse Accelerator (IWA) delivers superior performance for in-memory analytics processing... Read
2 Aug 12 - channelbiz - Oninit Group launches Pay Per Pulse cloud-based service... Read
28 May 12 - Bloor - David Norfolk on the recent Informix benchmark "pretty impressive results"... Read
23 May 12 - DBTA - Informix Genero: A Way to Modernize Informix 4GL Applications... Read
9 Apr 12 - Mastering Data Management - Upping the Informix Ante: Advanced Data Tools... Read
22 Mar 12 - developerWorks - Optimizing Informix database access... Read
14 Mar 12 - BernieSpang.com - International Informix User Group set to meet in San Diego... Read
1 Mar 12 - IBM Data Management - IIUG Heads West for 2012 - Get ready for sun and sand in San Diego... Read
1 Mar 12 - IBM Data Management - Running Informix on Solid-State Drives.Speed Up Database Access... Read
26 Feb 12 - BernieSpan.com - Better results, lower cost for a broad set of new IBM clients and partners... Read
24 Feb 12 - developerWorks - Informix Warehouse Accelerator: Continuous Acceleration during Data Refresh... Read
6 Feb 12 - PRLOG - Informix port delivers unlimited database scalability for popular SaaS application ... Read
2 Feb 12 - developerWorks - Loading data with the IBM Informix TimeSeries Plug-in for Data Studio... Read
1 Feb 12 - developerWorks - 100 Tech Tips, #47: Log-in to Fix Central... Read
13 Jan 12 - MC Press online - Informix Dynamic Server Entices New Users with Free Production Edition ... Read
11 Jan 12 - Computerworld - Ecologic Analytics and Landis+Gyr -- Suitors Decide to Tie the Knot... Read
9 Jan 12 - planetIDS.com - DNS impact on Informix / Impacto do DNS no Informix... Read
8 Sep 11 - TMCnet.com - IBM Offers Database Solution to Enable Smart Meter Data Capture... Read
1 Aug 11 - IBM Data Management Magazine - IIUG user view: Happy 10th anniversary to IBM and Informix... Read
8 Jul 11 - Database Trends and Applications - Managing Time Series Data with Informix... Read
31 May 11 - Smart Grid - The meter data management pitfall utilities are overlooking... Read
27 May 11 - IBM Data Management Magazine - IIUG user view: Big data, big time ( Series data, warehouse acceleration, and 4GLs )... Read
16 May 11 - Business Wire - HiT Software Announces DBMoto for Enterprise Integration, Adds Informix. Log-based Change Data Capture... Read
21 Mar 11 - Yahoo! Finance - IBM and Cable&Wireless Worldwide Announce UK Smart Energy Cloud... Read
14 Mar 11 - MarketWatch - Fuzzy Logix and IBM Unveil In-Database Analytics for IBM Informix... Read
11 Mar 11 - InvestorPlace - It's Time to Give IBM Props: How many tech stocks are up 53% since the dot-com boom?... Read
9 Mar 11 - DBTA - Database Administration and the Goal of Diminishing Downtime... Read
2 Feb 11 - DBTAs - Informix 11.7 Flexible Grid Provides a Different Way of Looking at Database Servers... Read
27 Jan 11 - exactsolutions - Exact to Add Informix Support to Database Replay, SQL Monitoring Solutions... Read
25 Jan 11 - PR Newswire - Bank of China in the UK Works With IBM to Become a Smarter, Greener Bank... Read
12 Oct 10 - Database Trends and Applications - Informix 11.7: The Beginning of the Next Decade of IBM Informix... Read
20 Sep 10 - planetIDS.com - ITG analyst paper: Cost/Benefit case for IBM Informix as compared to Microsoft SQL Server... Read
20 Jul 10 - IBM Announcements - IBM Informix Choice Edition V11.50 helps deploy low-cost scalable and reliable solutions for Apple Macintosh and Microsoft Windows... Read
20 Jul 10 - IBM Announcements - Software withdrawal: Elite Support for Informix Ultimate-C Edition... Read
24 May 10 - eWeek Europe - IBM Supplies Database Tech For EU Smart Grid... Read
23 May 10 - SiliconIndia - IBM's smart metering system allows wise use of energy... Read
21 May 10 - CNET - IBM to help people monitor energy use... Read
20 May 10 - ebiz - IBM Teams With Hildebrand To Bring Smart Metering To Homes Across Britain... Read
19 May 10 - The New Blog Times - Misurare il consumo energetico: DEHEMS è pronto... Read
19 May 10 - ZDNet - IBM software in your home? Pact enables five-city smart meter pilot in Europe... Read
17 March 10 - ZDNet (blog) David Morgenstern - TCO: New research finds Macs in the enterprise easier, cheaper to manage than... Read
17 March 2010 - Virtualization Review - ...key components of Big Blue's platform to the commercial cloud such as its WebSphere suite of application ser vers and its DB2 and Informix databases... Read
10 February 2010 - The Wall Street Journal - International Business Machines is expanding an initiative to win over students and professors on its products. How do they lure the college crowd?... Read

End of Support Dates
IDS 11.10 - 30 Sep 2012
Subscribe to notifications

IIUG on Facebook IIUG on Twitter

[ View Thread ] [ Post Response ] [ Return to Index ] [ Read Prev Msg ] [ Read Next Msg ]

IDS Forum

Re: New security check?

Posted By: david@smooth1.co.uk
Date: Thursday, 10 August 2017, at 4:48 p.m.

In Response To: Re: New security check? (Art Kagel)

..and all because the oninit binary checks $INFORMIXDIR/bin/oninit rather than being non-portable and doing something like checking argv[0] or /proc/<pid>/exe on Linux!

Jonathan, clearly a bug needs to be logged ;->>

Regards,
David.

> On 10 August 2017 at 21:03 Art Kagel <art.kagel@gmail.com> wrote:
>
>
> I agree Jonathan. No SUID script. I am going to go with the alias route.
> There's an environment script that user informix runs out of its profile.
> Will alias oninit there to a script somewhere outside of $INFORMIXDIR so I
> don't have to remember to copy it after an upgrade, the script won't be
> suid anything and will be owned by informix. It will execute
> "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to
> make sure that the environment is correct. That will get around the problem
> we are trying to solve which is someone modifying their environment after
> logging in and starting the engine manually (perhaps after a crash) with
> the wrong environment.
>
> Art
>
> Art S. Kagel, President and Principal Consultant
> ASK Database Management
> www.askdbmgt.com
>
> Blog: http://informix-myview.blogspot.com/
>
> Disclaimer: Please keep in mind that my own opinions are my own opinions
> and do not reflect on the IIUG, nor any other organization with which I am
> associated either explicitly, implicitly, or by inference. Neither do
> those opinions reflect those of other individuals affiliated with any
> entity with which I am affiliated nor those of the entities themselves.
>
> On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler <
> jonathan.leffler@gmail.com> wrote:
>
> > Be very cautious about making a shell script setuid.
> >
> > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk
> > >
> > wrote:
> >
> > > Art,
> > >
> > > Solved by making the oninit script setuid root, I wonder if this is to do
> > > oninit checking for a non-root installation?
> > >
> > > INVESTIGATION:
> > >
> > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)"
> > >
> > > Playing with strace I found that oninit does a stat of itself!
> > >
> > > I created my oninit script as user informix hence it did not have the
> > same
> > > permissons as the original oninit binary.
> > >
> > > Gradually matching permissions with the oninit binary I found that if you
> > > make
> > > the oninit script to be setuid root then the issue is resolved.
> > >
> > > chown root oninit
> > > chmod o-r oninit
> > > chmod o-x oninit
> > > chmod u+s oninit (Solved!)
> > >
> > > ls -l oninit*
> > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit
> > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su
> > >
> > > I suppose for completness we could do
> > >
> > > chmod g-w oninit
> > > chmod g+s oninit
> > > chmod o+r oninit
> > >
> > > ls -l oninit*
> > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit
> > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su
> > >
> > > Regards,
> > > David.
> > >
> > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote:
> > > >
> > > >
> > > > Interesting idea Dan. Have to think if that works in all circumstances,
> > > but
> > > > it sounds like a winner.
> > > >
> > > > Art
> > > >
> > > > Art S. Kagel, President and Principal Consultant
> > > > ASK Database Management
> > > > www.askdbmgt.com
> > > >
> > > > Blog: http://informix-myview.blogspot.com/
> > > >
> > > > Disclaimer: Please keep in mind that my own opinions are my own
> > opinions
> > > > and do not reflect on the IIUG, nor any other organization with which I
> > > am
> > > > associated either explicitly, implicitly, or by inference. Neither do
> > > > those opinions reflect those of other individuals affiliated with any
> > > > entity with which I am affiliated nor those of the entities themselves.
> > > >
> > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <
> > DDMueller@west.com
> > > >
> > > > wrote:
> > > >
> > > > > We do something similar except we used an alias named oninit. Do what
> > > you
> > > > > want
> > > > > with the alias and then call the real oninit.
> > > > >
> > > > > Dan
> > > > >
> > > > > -----Original Message-----
> > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf
> > Of
> > > Art
> > > > > Kagel
> > > > > Sent: Thursday, August 10, 2017 1:32 PM
> > > > > To: ids@iiug.org
> > > > > Subject: New security check? [39678]
> > > > >
> > > > > Folks:
> > > > >
> > > > > I renamed oninit and replaced it with a script that sets the
> > > environment
> > > > > then
> > > > > runs the renamed oninit binary. Wanted this to make certain that a
> > > manual
> > > > > restart has the correct environment settings.
> > > > >
> > > > > On startup using either the script or the renamed oninit the engine
> > > > > complains
> > > > > about the permissions on the root chunk and aborts the startup.
> > > > > Name oninit back to itself and all is well. Permissions on the root
> > > chunk
> > > > > and
> > > > > all the other chunk files are fine.
> > > > >
> > > > > I have done this many times in the past on earlier releases of
> > Informix
> > > > > with
> > > > > no issues. Is there some new security check in v12.10? Is there are
> > way
> > > > > around
> > > > > it?
> > > > >
> > > > > Art
> > > > >
> > > > > Art S. Kagel, President and Principal Consultant ASK Database
> > > Management
> > > > > www.askdbmgt.com
> > > > >
> > > > > Blog: http://informix-myview.blogspot.com/
> > > > >
> > > > > Disclaimer: Please keep in mind that my own opinions are my own
> > > opinions
> > > > > and
> > > > > do not reflect on the IIUG, nor any other organization with which I
> > am
> > > > > associated either explicitly, implicitly, or by inference. Neither do
> > > those
> > > > > opinions reflect those of other individuals affiliated with any
> > entity
> > > with
> > > > > which I am affiliated nor those of the entities themselves.
> > > > >
> > > > >
> > > > > ************************************************************
> > > > > *******************
> > > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > > >
> > > > >
> > > > > ************************************************************
> > > > > *******************
> > > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > ************************************************************
> > > *******************
> > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > >
> > >
> > >
> > > ************************************************************
> > > *******************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --
> > Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h>
> > Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org
> > "Blessed are we who can laugh at ourselves, for we shall never cease to be
> > amused."
> >
> >
> > ************************************************************
> > *******************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>

Messages In This Thread

[ View Thread ] [ Post Response ] [ Return to Index ] [ Read Prev Msg ] [ Read Next Msg ]

IDS Forum is maintained by Administrator with WebBBS 5.12.