Superfluous links in /etc ?
 

Hi everybody,

I was just having a look at the files in the /etc/ directory and I noticed something unusual. Why is it that there are so many links from /etc/ directory to binaries in /usr/bin and /usr/sbin yet the /etc/ directory is not in the path? I counted them and there are 52 out of 166 commands. This seems a great deal of redundancy to me. Surely it isn't more convenient typing /etc/binaryname than /usr/binaryname and if you did have "." in your path it would(hopefully) be last and the command would not be executed. I haven't seen this on Linux or BSD before, is there are reason why sun has done this??

Thanks in advance.

Good question.
The Same on our intel box at work, but NOT on our sparc boxes!

curiouser and curioser!


billy

Could it just be that Sun hasn't really given much effort into Solaris x86? I mean, I was checking /usr/sbin/ufsdump permissions and I get: lrwxrwxrwx. I mean, on Linux I get for /sbin/dumpe2fs: -rwxr-xr-x. Is it just me or is:
a) giving execute permssions bad
and
b) giving the world write permissions to something like ufsdump just going to invite trojans?

Is this standard for commercial Unices that they give such *cough* liberal *cough* permissions? bigearsbilly is this the same on the SPARCs? I mean don't they know (and linux is included - see $badblocks -wf /dev/hdX ) that giving the world these sorts of permsissions are just inviting trouble? :cry: I mean, Solaris/Linux give permissions of 0400 to /etc/shadow why don't they give a more secure default for other commands? I mean, I'd be much more concerned about somebody backing up the fs and then remounting where they have adequate permissions to read everyone's files or completely destroying the system. To make an analogy it seems as if you put a bowl of candy in front of kids and saying, now I'll be back in 20 minutes, don't eat the candy. :tisk: I realize ultimately that this is a SysAdmin problem but you have to admit that 777 is rich... hey rootshell here I come... :D

Not quite!

notice it's a link, links are always "lrwxrwxrwx"
un solaris they are anyway!

If you look at what it points at...


;-)


regards, billy

how about just: $mv trojan.sh usr/sbin/ufsdump ? What if I don't follow the link and just overwrite it? Same effect?

Oh, can I ask one more question? With this "ok prompt" does this exist on x86 or is it like eeprom for SPARC only? I mean I'm reading a few books obviously for SPARC and either they didn't have Solaris x86 back then or for the newer one (2000) it just doesn't mention anything about x86. Is something like
ok>scsi-probe
available for x86 (I know I don't have SCSI but regardless..)? All I seem to get is: select boot partition...boot....choose parameters or just enter to boot with defaults....startup..
It seems to me that this is a sparc thing as my keyboard doesn't have a STOP key on it, it does have an any key though! ;)

No, you can't touch it. (Try it!)

if you write to a link you write to the file.
Ignore the "permissions" on the link. The permissions
are what the file has.
and in this case it won't let ya!

You won't even be allowed to create a file in that
directory as a normal user. Just try to ls > newfile there.


billy
billy

coo, don't ask me, that's a bit too close to hardware for me! We leave ours on 24 hours and they're in 20 miles away!


billy

Yeah, I see that /usr/sbin doesn't have write permissions (I tried and failed to create a file there) but I thought that if you knew the location and it had the write permission then you could overwrite, this wouldn't even be a possibility if you knew the inode number? Anyway, I'm new at the fancy-schmancy Solaris stuff, loving learning on it, but you come to appreciate how linux distro's make it easier, or of course I'm biased as someone coming from Solaris might say, boy, these linux distros aren't as easy as solaris. Speaking of linux and solaris...So I'm searching for something like iptables/ipfw for solaris and I find out it doesn't have one builtin(Sunscreen..) and I'm like thinking:

Sun=$$$$ (I knew that you'd burn a hole somewhere with solaris)
Linux= :D

Anyway, I'll trudge ahead, the highlight of my day:

#mkdir /home/<localuser>
mkdir: Failed to make directory "localuser"; Operation not applicable

I'm like wtf? I'm root! So I put it in /export/home/ but I thought exports were for NFS? Oh, well I'm learning, that's the main thing but this different flavors of Unix thing, difficult sometimes...I just think nowadays, that these "distro-wars" are absolutely stupid, Linux distro's have more in common than they are different...

So bigears do you have experience in other bigiron Unices other than Solaris? If so, what do you think about them (sorry, I'm a student so I mean, I ask dumb questions, lol!)

So does anyone know about these /etc/ links in the first post?
Or the ok prompt??

have you been here?
http://www.sunfreeware.com/

I've worked a lot on DEC ALPHA boxes too, what's it
called again, tru64 or something.

To be honest from an application programming point of view
it makes no diff. to me really linux, Unix.
Except linux got loads more toys!

billy

thanks for the link!
bigearsbilly, can I ask one really stupid thing:<don't flame> I've always noticed that when I do a ps -e or -aux (solaris/linux) the PIDs seem to miss a bunch of numbers is this because init doesn't reuse PIDs? This seems especially noticable when I get some crazy process number like 5541 which I couldn't possibly be running consecutively. </don't flame> Goodnight anyway..

If anybody reads this, any ideas about the original purpose of the thread? or the "ok prompt"

I could be wrong, but i think it just autoincrements each process id, like init will always be 1 (from boot)

I think it "goes round the clock" eventually and reuses
free ones. (it must do really or it would run out eventually)

not sure though.

you do ask some funny questions!

regards, billy.
have a nice w/e

thanks bigears,
I ask some funny questions, eh? You mean I don't ask questions like "My new WOPR machine's hardware isn't compatible on this l337 *nix and now is threatening Thermonuclear Global Warfare, joshua says that Mr Falcon is missing, and I really need to impress this girl that totally wants to lay me..(Sorry to War Games!), oh on another note WINE won't install on it...please advise me of how to compile WINE so I can use cmd.exe, --thanks s.kiddie". I figure I can eventually work out my problems, I just ask questions about stuff that don't make sense to me - like the lofs a week ago, or that init question - I mean I would figure that it went around the clock because of the discrepancy in numbers, but I mean I've never read it anywhere, or these goddamn files in /etc/!!!

You have a good weekend too!

I see no links to binaries /usr/bin on my Solaris 9, but:
38 to /usr/sbin
15 to /sbin

I suspect these links are part of the live-upgrade functionality, which is a Solaris specific feature.

Sparc only, sorry (there is no openboot prom with intel architecture).

Are you really sure you didn't really launch the 5541 processes, even indirectly ?
Dont forget that one pid is created for every fork.
That means that a loop in a shell script can quickly consume hundreds of pids.

With Solaris 10 dtrace, you'll be able to trace each of these forks and execs.

Hi jlliagre,
Thanks for the info about the live-upgrade and the links in /etc/.
Thanks for the "ok prompt" info too.
In regards to the proceses, I'm not disputing that I haven't started that many processes accumulatively, I was just asking to confirm if others believed that init kept incrementing until it ran out of numbers. And then searched for "free" pids by "reaping" the numbers from the dead pids. It seems that at bootup the system must go through a fair number of pids as that is the only reason I can think of why the number is so high. Hey, I'll have to check out that dtrace in Solaris10!

KDE4me, pid numbering is to the best of my knowledge happening just like you describe in your last posting.
The number rolls at 29999 with Solaris, but you can change that by setting the pidmax variable in /etc/system, which can be up to 999999 I think.
5541 is not that crazy number ...
Did you mean you saw consecutive processes given distant pids ?