Subject: /usr/lib permissions question...

From: [email-masked] (Tom Lojewski)
Date: Sat, 25 Mar 1995 17:36:23 -0800 (PST)

Hello,

Could someone pleae explain the permissions setting for the files
contained in "ftp/usr/lib"?  I think we'd all like to minimize
permissions in the ~ftp area.  Why do some shared libraries need to
have execute permission enabled and some "read".  Do some need both?
Can I just enable "x" and not "r" on all of them?  Can you point me to
a man page or source that explains the theory behind shared libaries?

And if you are a SOLaris user and are inclined to answer:

On a SOLaris 2.4 machine, what are the MINIMUM /usr/lib permissions.
(I already know which files I need).

Thanks very much for considering this question.

--------------------------------------------------------------------------
Tom Lojewski  -  ACUSON Corp  -  Mountain View, CA - ([email-masked])

---

From: [email-masked] (Russell Street)
Date: Sun, 26 Mar 1995 17:19:27 +1200 (NZT)

> contained in "ftp/usr/lib"?  I think we'd all like to minimize

Shared libraries should be executable and readable.  They *have* to be
readable because the dynamic loader library has to search through them
for symbols.  I don't know/can't explain why they are executable --- I
took away the execute bits on some of my shared libraries (private
ones, NOT SYSTEM ONES, don't try that home kids, :-) and the program
that used was fine.

> Can I just enable "x" and not "r" on all of them?  

No. You get messages like:

ld.so.1: ./racd: fatal: libcrack.so: can't open file: errno=2
Killed

if you try that one.  Having execute permissions means very little, it
is read permissions that of interest to crackers anyway (retrieve your
shared library and scan it for known bugs :-()

As for the directory, I think you can get away with just execute
permissions on them.  A book on basic UNIX should be able to explain
the ins and outs of directory permissions.

> (I already know which files I need).

For Solaris 2.3, I have:

# ls -laR ~ftp/usr

/home/ftp/usr:
total 8
d--x--x--x   3 root     root         512 Oct 13 10:22 .
dr-xr-xr-x   8 root     root         512 Mar 24 12:54 ..
lrwxrwxrwx   1 root     root           6 Oct 13 10:22 bin -> ../bin
d--x--x--x   2 root     root         512 Oct 13 10:22 lib

/home/ftp/usr/lib:
total 2808
d--x--x--x   2 root     root         512 Oct 13 10:22 .
d--x--x--x   3 root     root         512 Oct 13 10:22 ..
-r-xr-xr-x   1 root     root       24576 Mar 28  1994 ld.so
-r-xr-xr-x   1 root     root       90312 Mar 28  1994 ld.so.1
-r-xr-xr-x   1 root     root      563684 Mar 28  1994 libc.so.1
-r-xr-xr-x   1 root     root        3296 Mar 28  1994 libdl.so.1
-r-xr-xr-x   1 root     root       12764 Mar 28  1994 libintl.so.1
-r-xr-xr-x   1 root     root      482984 Mar 28  1994 libnsl.so.1
-r-xr-xr-x   1 root     root       76088 Mar 28  1994 libsocket.so.1
-r-xr-xr-x   1 root     root       33052 Mar 28  1994 libw.so
-r-xr-xr-x   1 root     root       33052 Mar 28  1994 libw.so.1
-r-xr-xr-x   1 root     root       10496 Mar 28  1994 nss_dns.so.1
-r-xr-xr-x   1 root     root       16304 Mar 28  1994 nss_files.so.1
-r-xr-xr-x   1 root     root       25584 Mar 28  1994 nss_nis.so.1
-r-xr-xr-x   1 root     root       28828 Mar 28  1994 nss_nisplus.so.1
-r-xr-xr-x   1 root     root        9264 Mar 28  1994 straddr.so.2

Those are the libraries recommended in the Solaris man page (they have
not changed going to 2.4, I just did a diff on the man pages).

You could probably get away without the NIS things, and could even get
away without them at all if you build a static 'ls'.  

I have had success with removing the read permissions on the
directories (so you can't ls in there via ftp). Some people said on
this list that removing read permissions causes failures on their
systems. YMMV.

Hope this is of some help...

Cheers
Russell
 -------------------------------------------------------------------
 Russell Street ([email-masked]) +64 (9) 373-7599 extn 6487
   UNIX Systems Programmer, Computer Centre, University of Auckland
	     http://www.auckland.ac.nz/cc/People/RS.html

	   It's something to do with the shortage of money
	       and the holidays in the South of France.

---

From: [email-masked] (Patrick Salsbury)
Date: Mon, 27 Mar 95 14:38:43 PST

-I have had success with removing the read permissions on the
-directories (so you can't ls in there via ftp). Some people said on
-this list that removing read permissions causes failures on their
-systems. YMMV.
-
-Hope this is of some help...
-
-Cheers
-Russell
	I had a problem with it on SunOS 4.1.3_U1. Wouldn't work without 555
permissions on ftp/usr/lib.

Pat
-------------------------------------------------------------------------------
	  Patrick Salsbury 	                IXI/Visionware           
	Sys Admin/Webmaster             4500 Bohannon Dr., Suite #280  
	Voice: 415/325-2113	             Menlo Park, CA 94025      
	 FAX: 415/325-8710	      X/UNIX/PC Integration Specialists
 Check out <A HREF="http://www.visionware.com/">The Visionware Homepage</A>