Casper.Dik at Sun.COM wrote:
>> The effective uid must be root to run the program. In addition, if the
>> "-f" flag is specified, you really have to be root.
>>
>
>
> That is incorrect. (At least, it is bad for the program to enforce this;
> it MUST just attempt the system calls and have those fail or verify
> privileges but that is a relatively poor choice).
>
All the "-f" protects are the fopen(), fgets(), fclose() for reading the
specified file.
>
> Which privileges does it need for which functions?
>
1. geteuid() == 0, open raw socket, then the euid is reset immediately:
seteuid( getuid() )
2. Subsequent parsing of the command line then checks getuid() == 0 if
the "-f" option is specified.
3. getuid()==0 is also checked if:
interval specified is less than 1 second ("-i" option)
per host interval is less than 2 seconds ("-p" option)
timeout interval is less than 5 seconds ("-t" option)
retry limit is greater than 20 ("-r" option)
> Will the program be added to the appropriate RBAC profile?
>
Yes.
--
Dan Hain
Solaris Revenue Product Engineering (RPE)
http://namefinder/NameFinder?nfquery=-s+88796
--------------------------------------------------------------
NOTICE: This email message is for the sole use of the
intended recipient(s) and may contain confidential and
privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are
not the intended recipient, please contact the sender
by reply email and destroy all copies of the original message.
--------------------------------------------------------------
