Re: Interesting suid problem

[rsteinke w-link net]

From: Jeff Shipman - SysProg <jeff nmt edu>
>
> Care to elaborate?
>
> Jeff Shipman           E-Mail: jeff nmt edu
> Systems Programmer     Phone: (505) 835-5748
> NMIMT Computer Center  http://www.nmt.edu/~jeff
>
> On Thu, 21 Feb 2002 rsteinke w-link net wrote:
>
> } From: Jeff Shipman - SysProg <jeff nmt edu>
> } >
> } > I'm using Oracle and some columns of some
> } > tables should be viewable to some users while
> } > other columns of the same table are viewable.
> } > I would have to write out a billion different
> } > queries, different ones for each access
> } > level to do this. Kinda infeasible, IMO espcially
> } > since our queries may change often depending
> } > on new features we add to the software.
> } >
> } > Jeff Shipman           E-Mail: jeff nmt edu
> } > Systems Programmer     Phone: (505) 835-5748
> } > NMIMT Computer Center  http://www.nmt.edu/~jeff
> } >
> } > On Thu, 21 Feb 2002 rsteinke w-link net wrote:
> } > }
> } > } Can't you make the database itself able to enforce user access
> } > } to certain databases? I think Postgresql can do this.
> }
> } That's what shell scripts are for.
> }
> } Ron Steinke
> }

I'm assuming oracle has some command line interface/way to send batch commands
or something.

Write a shell script for each set of permissions (I'm assuming that, while
you have many, many users, there are only about three or four access levels)
that is passed a user name and writes to stdout the sql commands necessary
to create that user with the appropriate permissions.

Then, write a shell script that loop through the list of users you've been
given, calls the appropriate permission-generating shell script, and
pipes the output to oracle.

This will require maintainance of the shell scripts as you update your database
version/requirements, but not more so than you would need ysing any other
means of enforcing this.

You can also write little update scripts to change the permissions of users
from one level to another in mid-stream, if that's necessary.

This method is also probably more secure than having a separate password
file, as it reduces the possible number of points of failure.

All pretty standard sysadmin stuff.

Ron Steinke