[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Root ownership of rpc.ldmd

Brad Teale wrote:
> 
> Anne,
>   Is there a flag that needs to be specified when you don't want to use the
> portmaper because the ldmadmin script won't start anything without portmaper
> running.  If there is not a flag, then the whole port 388 is not really
> needed because portmaper will resolve the port the rpc takes place on.
> 
> Also, I was starting the ldm as the ldm user.  I meant to say when I start
> rpc.ldmd as ldm with the setuid bit on it doesn't start anything else.
> 

Hi Brad,

No, there is not flag to specify that you don't want to use the
portmapper.

It is news to me that the ldm won't start anything without a portmapper
running.  If I had more free time I would test this myself.  Like I said
earlier, if the ldm can't get port 388 then it will rely on portmapper
services.  Thus, it does want to register with the portmapper (which
also requires root priveleges).   In looking at the code, it looks like
it will exit with an error if it's not able to register with the
portmapper.

But, your symptoms, as I understood them, was that the ldm was running
successfully, but it would not exec anything.   That still sounds to me
like the ldm was being started as root, and your system is configured so
that root is not allowed to run anything not owned by root.  By the way,
were there any relevant messages in your system log?

Yes, the ldm could have been coded to rely only on the portmapper, but
for reasons of security that path was not chosen.

Anne
-- 
***************************************************
Anne Wilson                     UCAR Unidata Program            
address@hidden                 P.O. Box 3000
                                  Boulder, CO  80307
----------------------------------------------------
Unidata WWW server       http://www.unidata.ucar.edu/
****************************************************