How to Permit Access to SNA Commands to a non-root, non-system USER


User is getting error 0513-019 when he tries to start the sna
subsystem as a non-root user.  System informs him that he must be root or 
member of group 'system' for this to work.  He wants the non-root person
charged with SNA administration to have access to the sna set of commands:
starting and stopping the subsystem,  link stations, and sessions; 
viewing the status of sna; starting and stopping traces, formatting them, 
and the like.  By default these commands, with the exception of 
formatting traces and logs and viewing the status of SNA, are available 
only to 'root' or a member of the 'system' group. Customer wants to permit 
access to the SNA commands but not the more wide-ranging capabilities 
associated with 'root' or 'system'.  Is there a way to grant root-like 
access to this person ONLY for the SNA functions?

This is basically an AIX security issue, not an AIXSNA issue.
Please see InfoExplorer for details on the commands mentioned below.
Please read "System Security Guidelines" in InfoExplorer before 
making any of the changes mentioned below.


All of the SNA commands to manipulate the sna subsystem are in/usr/bin.

\# cd /usr/bin
\# ls *sna*

chsnaobj        lssnaobj        rmsnapw         snaca_dlu.cfg   snasub
chsnapw         migratesna      sna             snacomp         verifysna
exportsna       mksnaobj        sna3270lu       snaevent        xsna
gensnakey       mksnapw         sna_command     snaformat
helpsnaobj      qrysnaobj       sna_display     snagwlus
importsna       rmsnaobj        snaca_5250.cfg  snalu0lus

You could create a new group (maybe aixsna), make the aixsna admin
a member or this group and then change group ownership of the various
sna commands to 'aixsna'.  Note that 'system' group members would
no longer be able to issue these commands.

You could allow a non-root, not-system, user to execute any command
by changing executable permission for the "other" users of that command 
with the chmod command but this would apply to all other users.

You could allow a person who is not root or a member of the system group
to use these commands by setting the 'sticky bit'.  This can be
done if root does the following:

   \# cd /usr/bin
   \# chmod u+s *sna*

This effectively allows 'other' users to execute these commands 'as if'
they were root.   The permissions previously restricted to the root 
user will now be available to all other users for these commands. 

If you just want permission to start and stop the subsystem, links,
and sessions, then you need only set the permissions to files 'sna'
and 'sna_command'.  File 'sna' is a script that takes as arguments
flags which are interpreted by sna_command to perform the required

Either option allows the 'aixsna administrator' to do sna commands.

The corresponding smit commands will also be accessible to the user
by making these changes.  If all the commands were permitted, everything
in smit would be available to this user.

One potential problem with this relates to allowing *anyone*
to execute SNA commands.  If you change the group ownership from 
system to, say aixsna (i.e defined a group called 'aixsna'), add the SNA 
Administrator to this group, and then change the permissions to grant 
setuid capability, it will NOT work without additional changes 
(described below).  

The Group ID of this newly added group will NOT be Zero, since the System
group is assigned this group id by default. Also, TWO GROUPS CANNOT
SHARE THE SAME GROUP ID.  If the sna commands above were assigned
group ownership of aixsna 
   \# chgrp aixsna *sna*
and this group id WAS set to zero, a member of the sna group would be 
able to perform SNA commands,  but this effectively makes 'aixsna' group 
the defacto 'system' group for all AIX functions and commands.
If this aixsna group does not have group id of zero,
the following error will occur:
 0513-019: System Resource Controller requires that you be
running as root or be part of the group system

When you run sna commands, the system look at the uid and gid and if
at least one is not 0, they will not run.

If the command is looking at the EFFECTIVE uid, you can try this:

   \# chmod 4750 sna (set suid root)
   \# chmod 4750 sna_command 
   \# ls -l sna sna_command

This also disables permissions for others
-rwsr-x---   1 root     system      1200 Aug 21 1774  sna.
-rwsr-x---   1 root     system    571954 Aug 21 1774  sna_command

Then do an acledit on these two file to set extented permissions on, and 
permit the group you want to execute. The aclfile looks like:

attributes: SUID SGID
base permissions
    owner(root):  rwx
    group(sna):  r-x
    others:  r-x
extended permissions

attributes: SUID
base permissions
    owner(root):  rwx
    group(system):  r-x
    others:  ---

extended permissions
    permit   r-x     g:groupname 

Note you can do u:user if you do not wish to define a group.

You will have to do this for both files.  If you want ALL of the 
sna commands mentioned above permitted to this user, perform the
above step for all of those files.

You can test this by logging in as an ordinary user and the doing
   \# su - user 
(where 'user is member of the aixsna group).
Then try running the sna command. You must set the permissions
on the sna_commands as well before you try it. 

If both sna and sna_command have perms of 4750 and externded permissions
enabled for the user or group, that user will be able to manipulate the 
aixsna subsystem.
You can also use chown (change owner) or chgrp (change group) on any
file or executable.  The id command will return user id and group id
information for any AIX user.
Please read "System Security Guidelines" in InfoExplorer.
Of course simply adding the aixsna administrator to the "system" group is
the simplest way to allow that person to issue aixsna commands.

Support Line: How to Permit Access to SNA Commands to a non-root, non-system USER ITEM: BG6805L
Dated: May 1996 Category: N/A
This HTML file was generated 99/06/24~13:30:22
Comments or suggestions? Contact us