HP Visualize J5000 hp enterprise file system: planning and configuring hp DCE/ - Page 36

Handling of setuid Programs and Device Files in DFS

Get HP Visualize J5000 - Workstation PDF manuals and user guides View all HP Visualize J5000 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 36 highlights

Installing and Configuring Enhanced DFS 3.0 Handling of setuid Programs and Device Files in DFS Handling of setuid Programs and Device Files in DFS By default, the DFS Cache Manager (that is, the DFS client) does not allow a setuid program to change the effective uid or gid of the process executing it. The cm setsetuid command directs the DFS to permit a setuid program to change the effective uid or gid. cm setsetuid takes a file name or directory name as an argument, but DFS applies the setuid control to the whole fileset containing the specified file or directory. The cm setsetuid command must be executed on the DFS client node by root; it is normally done as part of node start-up. The shell script below suggests a method to do this. Also by default, the DFS Cache Manager does not honor device files stored in filesets in the global name space. The cm setdevok and cm getdevok commands control and check this feature. They must be executed on the DFS client node by root. The code below can be used to manage this feature as well as the setuid feature described above. To use this method to control DFS handling of setuid programs and device files, run the following script as root after DFS has started. If you also want to control device files, run a similar script substituting items as follows: For This dfs_setuid.conf setsetuid Substitute This: dfs_devok.conf setdevok setuid Script #!/bin/ksh # # Program name: program_name # Purpose:to set setuid states for filesets in DFS # Config files: # /:/common/etc/dfs_setuid.conf # /etc/dfs_setuid.conf 36

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
36
Installing and Configuring Enhanced DFS 3.0
Handling of setuid Programs and Device Files in DFS
Handling of setuid Programs and Device Files in DFS
By default, the DFS Cache Manager (that is, the DFS client) does not allow a
setuid
program to change the effective
uid
or
gid
of the process executing it.
The
cm setsetuid
command directs the DFS to permit a
setuid
program to
change the effective
uid
or
gid
.
cm setsetuid
takes a file name or directory
name as an argument, but DFS applies the
setuid
control to the whole fileset
containing the specified file or directory.
The
cm setsetuid
command must be executed on the DFS client node by
root
; it is normally done as part of node start-up. The shell script below
suggests a method to do this.
Also by default, the DFS Cache Manager does not honor device files stored
in filesets in the global name space.
The
cm setdevok
and
cm getdevok
commands control and check this
feature. They must be executed on the DFS client node by
root
. The code
below can be used to manage this feature as well as the
setuid
feature
described above.
To use this method to control DFS handling of
setuid
programs and device
files, run the following script as
root
after DFS has started. If you also want
to control device files, run a similar script substituting items as follows:
setuid Script
#!/bin/ksh
# # Program name: program_name
# Purpose:to set setuid states for filesets in DFS
# Config files:
# /:/common/etc/dfs_setuid.conf
# /etc/dfs_setuid.conf
For This
Substitute This:
dfs_setuid.conf
dfs_devok.conf
setsetuid
setdevok