IDS Forum

Re: How to Check the Security of $INFORMIXDIR ....

Posted By: Jonathan Leffler
Date: Tuesday, 12 August 2008, at 1:05 p.m.

In Response To: Re: How to Check the Security of $INFORMIXDIR and (Jim Tranny)

On Tue, Aug 12, 2008 at 7:03 AM, Jim Tranny <jimtranny@gmail.com> wrote:
> On Sat, Jul 26, 2008 at 12:32 AM, Jonathan Leffler
> <jleffler.iiug@gmail.com> wrote:
>> Some, maybe even many, of you have heard me say "Make sure that
>> $INFORMIXDIR and all the directories in the path leading to it are
>> secure" and "Make sure that the paths leading to your chunks are
>> secure", but how many people are really sure they know when something
>> is secure and when it is not really secure?
>>
>> OK - there was at least one hand moving out there near the back of the
>> audience - just a little.
>>
>> I've uploaded a program to the IIUG Software Archive (hint, hint - O
>> Keepers of the IIUG Software Archive - and it is the second version,
>> 2.34, that should be made public, please) called linkpath which is my
>> current tool for assessing whether a path leading to a file (or a
>> directory) is really secure. It should compile on just about any
>> version of Unix or Linux you can lay hands on; I've compiled it on
>> HP-UX, Solaris 10, Linux, AIX, and MacOS X.
>>
>> Usage: linkpath [-adhsvV][-u user][-g group] file [...]
>> -a Process absolute names
>> -d Print diagnostic output
>> -g group Treat user as trusted
>> -h Print this help message and exit
>> -s Security check directories
>> -u user Treat user as trusted
>> -v Verbose mode
>> -V Print version and exit
>>
>> The program chases down insecure directories - defined as a directory
>> that is publicly writable, or a directory that is owned by a
>> non-trusted group that is group writable, or a directory that is owned
>> by a non-trusted user. It reports on insecure files too. It follows
>> symlinks, but analyses the path that the symlink traverses to make
>> sure there are no insecure directories on the way. The trusted users
>> are root, bin, sys and informix; the trusted groups are bin, sys,
>> informix, and group 0 (sometimes root, sometimes wheel (MacOS X),
>> sometimes system (AIX)), and the group that owns the root directory
>> (admin, 80, on MacOS X; group 0 on other systems).
>>
>> I am interested to know (a) if you have any problems compiling it
>> (platform - o/s and compiler - would be relevant), and (b) whether any
>> of your INFORMIXDIRs are insecure. One way of checking that is:
>>
>> linkpath -sv `cat /INFORMIXTMP/.infxdirs`
>>
>> Or - Korn Shell or Bash:
>>
>> linkpath -sv $(</INFORMIXTMP/.infxdirs)
>>
>> One reason for asking is to find out how much trouble would be caused
>> if a security check based on this code was added to fix packs of IDS,
>> with ON-Init in particular not starting unless $INFORMIXDIR was secure
>> according to the criteria checked by this code.

> I'm not sure if you prefer to keep this off the list...

No problem at all. It's just a bug in my code -- it happens, despite
all the testing I do.

> On my CentOS release 5.2 system I get an error saying 'invalid user
> 'sys''. Here's the output from linkpath -sdv `cat
> /INFORMIXTMP/.infxdirs`:
> root directory: st_dev - 64768, st_ino = 2, st_gid = 0
> grp bin => gid 1
> grp sys => gid 3
> grp informix => gid 344
> usr root => uid 0
> usr bin => uid 1
> usr sys => unknown!
> linkpath: invalid user 'sys'
>
> FYI, I have a group called 'sys' but not user called 'sys' on all my
> Linux systems:
> Red Hat Enterprise Linux ES release 4 (Nahant Update 6)
> CentOS release 5.2

Thanks for the information.

I had to make a related fix (no user bin or sys on MacOS X) earlier
today (as well as another fix to prevent a core dump on Solaris 9
because its bsearch on zero-length lists tries poking around the
non-existent data - other platforms all handle that case fine!) and
made the equivalent fix in the group handling, even though I didn't
know it was needed (mainly to retain as much symmetry as possible).
I'll send you the new version directly, Jim, and will upload to the
IIUG web site.

--
Jonathan Leffler #include <disclaimer.h>
Email: jleffler@earthlink.net, jleffler@us.ibm.com
Guardian of DBD::Informix v2008.0513 -- http://dbi.perl.org/
"Blessed are we who can laugh at ourselves, for we shall never cease
to be amused."
NB: Please do not use this email for correspondence.
I don't necessarily read it every week, even.

Messages In This Thread

• How to Check the Security of $INFORMIXDIR and Chun
  Jonathan Leffler -- Saturday, 26 July 2008, at 12:32 a.m.
  • Re: How to Check the Security of $INFORMIXDIR and
    Jim Tranny -- Tuesday, 12 August 2008, at 10:03 a.m.
    • Re: How to Check the Security of $INFORMIXDIR ....
      Jonathan Leffler -- Tuesday, 12 August 2008, at 1:05 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.