bugTiger UNIX security tool - Bugs: bug #8030, wrong flags used for Solaris...

 
 

bug #8030: wrong flags used for Solaris binaries

Submitted by:  None
Submitted on:  Sat 06 Mar 2004 01:20:34 PM UTC  
 
Category: Security check modulesSeverity: 5-Critical
Item Group: Runtime errorStatus: None
Privacy: PublicAssigned to: Javier Fernandez-Sanguino Peña <jfs>
Open/Closed: OpenOperating System: Solaris

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 28 Apr 2004 08:40:58 AM UTC, comment #3:

Thanks for all this information. One of my TODO items is to fully test Tiger in latest Solaris versions, which I have not been able to do due to a lack of time. I will fix this issues when time permits.

Some of your fixes (like the one in 'check_passwd') will probably be added to CVS soon.

Javier Fernandez-Sanguino Peña <jfs>
Project AdministratorIn charge of this item.
Mon 08 Mar 2004 02:03:23 PM UTC, comment #2:

Ok, here's one more: something like

getpermit ${home%/*}/

while fine in, say, bash, will not work in Solaris' /bin/sh, where instead you would get a

./check_accounts: bad substitution

error. However, changing /bin/sh to /bin/bash unfortunately isn't a viable solution, as Solaris need not come with /bin/bash. So what's to do?

Anonymous
Mon 08 Mar 2004 01:29:04 PM UTC, comment #1:

Ok, simply replacing /usr/bin/grep with /usr/xpg4/bin/grep alas was only part of the solution, e.g. in check_passwd I also needed to change line 255 from

$GREP -Ev ^$admin_account_list: $WORKDIR/p1uid.$$ |

to

$GREP -Ev "^$admin_account_list:" $WORKDIR/p1uid.$$ |

for this to work.

talking about check_passwd, I had to set

Tiger_Passwd_Hashes='*'

for tiger not to complain about all the xxxxxxxxxxxxx it itself introduced as hashes...

Sven

Anonymous
Sat 06 Mar 2004 01:20:34 PM UTC, original submission:

Hi,

running tiger 3.2.1 on Solaris 8 I get a number of error-messages like the following:

/usr/bin/grep: illegal option -- E
Usage: grep -hblcnsviw pattern file . . .

/software/tiger-3.2.1/tiger/scripts/check_accounts: /usr/bin/egrep -s: not found
/software/tiger-3.2.1/tiger/scripts/check_accounts: bad substitution

/software/tiger-3.2.1/tiger/util/getnetgroup: grphosts#=: not found

/software/tiger-3.2.1/tiger/scripts/check_rhosts: test: argument expected

To me this suggest that you are using the solaris binaries (I know you do) with flags only suitable for the GNU-versions (I suspect).

Now, for me this is easily fixed by patching ./systems/SunOS/5/5.8/config and relatives (since I do have the GNU versions hidden away someplace), but in general it seems more adequate to either explicitly require the GNU-versions (and have configure find out their location) or even better to use a subset of flags compatible with Solaris. Or you could use different binaries, under Solaris e.g. /usr/xpg4/bin/grep has the flag -E, while /usr/bin/grep has not.

Hope this helps

Sven

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Wed 28 Apr 2004 08:40:58 AM UTCjfsAssigned toNone=>jfs

Back to the top


Powered by Savane 3.1-cleanup