HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

acquire their attributes from the object, giving the user the same access rights as the
program's owner and group.
• If the setuid bit is turned on, the privileges of the process are set to that of the
owner of the file.
• If the setgid bit is turned on, the privileges of the process are set to that of the
group of the file.
• If neither the setuid nor the setgid bit is turned on, the privileges of the process
are unchanged.
• As a particularly risky case, if a program is setuid to root, the user gains all
privileges available to root. This is dangerous because the program can be used
in a way that violates system security. To a lesser extent, this problem exists in
other setuid and setgid cases as well.
For security reasons, the setuid and setgid bits on scripts are normally ignored by
the HP-UX kernel. This rule can be relaxed by changing the tunable
secure_sid_scripts, but it is strongly recommended that this tunable be not
changed from the default. For more information on this tunable, see secure_sid_scripts(5).
2.6.2 How IDs Are Set
IDs are set in these different ways:
• The ruid and rgid are inherited from the login process, which sets your uid
and gid. The uid and gid values are specified in /etc/passwd.
• The login command also changes the ruid, euid, rgid, and egid.
• The su command changes the euid and ruid.
• The newgrp command can change the gid.
• Set the setuid and setgid bits by using the chmod system call or chmod
command. See chmod(1) and chmod(2) for more information.
2.6.3 Guidelines for Limiting Setuid Power
Use caution if you add setuid-to-root programs to an existing system. Adding a
setuid-to-root program changes the system configuration and might compromise
security.
Enforce restrictive use of privileged programs through the following administrative
and programming recommendations:
• Use setuid and setgid only when absolutely necessary.
• Make sure that no setuid program is writable by others.
• Whenever possible, use setgid instead of setuid to reduce the scope of damage
that might result from coding flaws or breaches of security.
• Periodically search the file systems for new or modified setuid and setgid
programs. You can use the ncheck -s command.
2.6 Handling setuid and setgid Programs 51