Conference decalp::rtrnotes

688.0. "Potential socket file protection problem with RTR V3.1B or 3.1C on Digital Unix 4.0" by TALER::WROBEL (Stan Wrobel) Tue Apr 08 1997 15:49

RTR User Advisory
-----------------

With Digital Unix V4.0 and higher, the default behavior of the
bind() system call is different from Digital Unix V3.x with regard to
the protection masks of socket files.  This change has an effect on
RTR users in that application programs running in a user's process
space may not have sufficient privilege to open a socket connection to
the RTR ACP that is running in the root process space.

To avoid this problem, RTR users on machines running Digital Unix 4.0
or higher may either follow the system configuration suggestion in
the "Digital Unix 4.0 Release Notes" and in "man bind(2)",
or use one of the following commands to start RTR:

        (umask 0;rtr start rtr)
        (umask 2;newgrp rtruser;rtr start rtr)

Please be aware that this has security implications. The second
command is more suitable if you are concerned about other users
accessing sockets belonging to the RTR ACP inadvertently or with
malicious intent.  It assumes that you have already configured
your system to have a group called 'rtruser'.  Consult your Unix
System Administrator for details.

Note that umask and newgrp are shell commands described in the man pages
for sh(1) csh(1) ksh(1).
 

    BTW, this is for the current RTR release for DUX V4 and is fixed in a 
    future RTR release.
    
>         (umask 0;rtr start rtr)
>         (umask 2;newgrp rtruser;rtr start rtr)
> 
    Or, setgid the rtr executable to rtruser, and:
    
    	  (umask 2;rtr start rtr)
    	  
    Ed