hi all,

i have a binary for which it includes libraries from
from /usr/lib and some informix libraries which are obtained from the path $INFORMIXDIR/lib/esql

everything is fine, with respect to the binary and the dynamic dependencies include of the binary.

but when i set the s-bit for the binary on user and upon using ldd
only the libraries from default directory /usr/lib/ are listed and not from the INFORMIX library paths.

when tried querying from google got few points that
due to security reasons for a binary for which set bit is set on the user or group the dynamic dependencies will not be included.

if that is the case, then how can i overcome this...

any pointers on this greatly apprecited!!!

thanks in advance

A good generic way is to call the program using sudo. You can configure the call to not require a password even. Install the sudo program.... then do visudo to create the rules (brings up vi editing the file /etc/sudoers).

Consider the following rule:

cjcox ALL=(wwwrun) NOPASSWD:/usr/bin/id

This says that the user cjcox is allowed to execute the command /usr/bin/id as the user wwwrun. I can invoke it like so (assume I'm logged in as cjcox):

$ sudo -u wwwrun /usr/bin/id
uid=30(wwwrun) gid=8(www) groups=8(www)

Of course, that may be too long of a command to type. So perhaps I will setup an alias via a script or bash shell alias...

$ alias wwwid="sudo -u wwwrun /usr/bin/id"
$ wwwid
uid=30(wwwrun) gid=8(www) groups=8(www)

thanks for the reply...

the actual issue is not with how to sudo to the required id and invoke the program..

the question on raise is..
what happens to the linked dependencies when s-bit on user or group is set for the binary...

only the libs from /usr/lib/ are displayed and not the external libs.. if that is the case how is it possible to include them with s-bit still set on the binary ?

See man ld.so for an explanation of how LD_LIBRARY_PATH is NOT used for setuid programs. You can bind in the path to the dynamic libraries into the program.. or use the "sudo" style technique I described.

I was merely trying to provide a solution.... Sorry, I should have pointed to the information...