MQSeries.net :: View topic - Does mqsistart become root at some point?

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » Does mqsistart become root at some point?

Does mqsistart become root at some point?

« View previous topic :: View next topic »

Author

Message

sjensen

Posted: Tue Mar 07, 2006 9:48 am Post subject: Does mqsistart become root at some point?

Centurion

Joined: 18 Dec 2003
Posts: 134
Location: London

Hi,

It seems that some program executed during the mqsistart becomes root.

The reson I think so it that we run with ETrustAC (SeOS) and on a machine without a rule allowing it I get this Denial:

Code:

07 Mar 2006 11:56 D SURROGATE u063492 Read 69 2 USER.root /opt/IBM/mqsi/6.0/bin/mqsistart.bin UserName

and the start get killed. If this rule is added:

Code:

authorize SURROGATE USER.root access(READ) uid(UserName) via(pgm(/bin/su))

it works.

I am
A ) Confused why it become root as it seems it does and
B) Totally confused how it does it as I can find no setuid bit on any of the
binaries.

Platform Sorlais 8, WMQ5.3 CSD8, WMB6

Many thanks in advance for any help

Stefan

wschutz

Posted: Tue Mar 07, 2006 4:30 pm Post subject:

Jedi Knight

Joined: 02 Jun 2005
Posts: 3316
Location: IBM (retired)

is there any chance that "root" was specified as your ServiceUseriD when the broker was created?
_________________
-wayne

sjensen

Posted: Wed Mar 08, 2006 3:59 am Post subject:

Centurion

Joined: 18 Dec 2003
Posts: 134
Location: London

Quote:

is there any chance that "root" was specified as your ServiceUseriD when the broker was created?

No the user Id was mqsifire.

I've found the reason - the mqsistart.bin issues an

Code:

getuid() = 30001 [30001]
seteuid(0) Err#1 EPERM

Now when the seteuid(0) fails it continues and starts the broker under the ID you are running as. Presumably this code is there so if the seteuid(0) worked the broker will be started under the ServiceUserId.

That the ServiceUserId and Password is ingored normally can be shown by creating a broker with a non existing Id and then starting it:

Code:

$ mqsicreatebroker SLJ4 -i invalid -a invalid -q SLJ4 -n WBRKBKDB -u Secret -p secret
AMQ8110: WebSphere MQ queue manager already exists.
WebSphere MQ queue manager running.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
The setmqaut command completed successfully.
BIP8071I: Successful command completion.

$ mqsistart SLJ4
WebSphere MQ queue manager running.
BIP8096I: Successful command initiation, check the system log to ensure that the component started without problem and that it continues to run without problem.

$ ps -ef|grep SLJ4|grep bip
mqsifire 23282 23281 4 11:53:46 ? 0:01 bipbroker SLJ4
mqsifire 23281 1 1 11:53:46 ? 0:00 bipservice SLJ4
mqsifire 23299 23282 3 11:53:53 ? 0:01 biphttplistener SLJ4

$ mqsistop SLJ4
BIP8071I: Successful command completion.

Indeed any user in group mqm and mqbrkrs with acess to the working directory and the right environment can start the broker and it will then run under that user ID:

Code:

$ id
uid=1009(mqm) gid=145(mqm)

$ . ./.profile

MQSI 6.0.0.0
/opt/IBM/mqsi/6.0

$ mqsistart SLJ4
WebSphere MQ queue manager running.
BIP8096I: Successful command initiation, check the system log to ensure that the component started without problem and that it continues to run without problem.

$ ps -ef|grep SLJ4|grep bip
mqm 23430 23429 4 11:55:40 ? 0:01 bipbroker SLJ4
mqm 23429 1 1 11:55:40 ? 0:00 bipservice SLJ4
mqm 23443 23430 7 11:55:44 ? 0:02 biphttplistener SLJ4

So when using ETrustAC rules need to be in place to allow the mqsistart to run.

Thanks
Stefan

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » Does mqsistart become root at some point?

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP