UNIX for Advanced & Expert Users

In our project we have several unix scripts that trigger different processes. These scripts write logs to a particular folder 'sesslogs', create output data files in a separate directory called 'datafiles' etc. Usually L1 support team re-run these scripts . We donot want L1 support team to have write access to any of the 'Sesslogs' or 'datafiles' folder as they could accidentally delete the critical files in these folders. So we would like their account 'operator' to have no write permission on these folders but just read and execute. At the same time when they run these shell scripts using the 'operator' account, the shell scripts must be able to create the new logfiles in the 'SessLogs' folder and also write output datafiles to the 'datafiles' folder.
How can this be achieved at the same time that 'operator' cannot manually delete or create a file in the SessLogs/datafiles folder.
Please advise.

thanks
waavman

Check out setuid/setgid.
A small c program / executable with setuid set could achieve your goal.

Thanks Peasant.
We have about 50 scripts like that. Does it mean I have to create a wrapper script for each of the 50 scripts which invokes those scripts using the C executable ?
Eg: for script1.ksh I should create script1_wrapper.ksh which contains inside it

Code:

eval `cexecutablename script1.ksh`

Similarly for script2.ksh I should create script2_wrapper.ksh which contains

Code:

eval `cexecutablename script2.ksh`

and so on...

Is that a correct assumption or is there another approach which does not involve creation of 50 new wrapper scripts ?

thanks

With ksh and a tradional Unix (not Linux) you can directly have script1.ksh suid, owned by the data owner, and a shebang

Code:

#!/bin/ksh -p

--
The alternative is sudo. Every script is one entry in sudoers.

Yes the #!/usr/bin/ksh -p option will not work for me because the servers run SuSE 10.4 Linux

sudoers example

Code:

ALL ALL = (operator) NOPASSWD: /path/to/script1.ksh

Run with

Code:

sudo -u operator script1.ksh

I chose the setuid option because with the sudoers option, for every new script we add, there would be dependency on the SA's adding the script entry to the sudoers file.
With the setuid option I am able to get half way there. But I am facing this issue. I just simplified the script for asking the question in this forum. The C binary is name 'invokescript'. This script basically invokes the shell script passed as argument to it using execvp

wrapperscript.ksh invokes script.ksh as follows

Code:

#!/usr/bin/ksh
/tmp/invokescript /tmp/script.ksh

script.ksh has the following lines. Note that env.sh sets up the PATH and LD_LIBRARY_PATH environment variables fort ORACLE command line interface sqlplus 

#!/usr/bin/ksh
. <path>/env.sh
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH"
echo "LDD OUTPUT"
ldd `which sqlplus`
echo "SQLOUTPUT"
sqlplus -s dbuser/dbpasswd@dbname <<EOF
sqlstatement;
EOF

script.ksh, wrapperscript.ksh and invokescript are owned by user 'cdds'
invokescript C binary has SETUID bit set for owner 'cdds'.

When the owner 'cdds' runs wrapperscript.ksh I get the following output:

L

Code:

D_LIBRARY_PATH=blahblahblah:/app/oracle/lib:blahblahblah
LDD_OUTPUT
blahblahblah=>blahblahblah
libsqlplus.so=>/app/oracle/lib/libsqlplus.so (0x00002b03d8075000)
libc.so.6=>/lib64/libc.so.6 (0x00002b03.....)
blahblahblah=>blahblahblah

SQLOUTPUT
<The correct sqloutput comes here>

But when I run wrapperscript.ksh as 'cddsoper' user I get an error that can be understood by the following output:

Code:

LD_LIBRARY_PATH=blahblahblah:/app/oracle/lib:blahblahblah
LDD_OUTPUT
blahblahblah=>blahblahblah
libsqlplus.so=> not found (0x00002b03d8075000)
libc.so.6=>/lib64/libc.so.6 (0x00002b03.....)
blahblahblah=>blahblahblah

sqlplus: error when loading shared libraries: libsqlplus.so: cannot open shared object file: no such file or directory

Based on the above output the question is as follows:
Even though the LD_LIBRARY_PATH contains the same value whether we run the wrapperscript.ksh as owner 'cdds' or user 'cddsoper' and /app/oracle/lib exists in both runs, when running as 'cddsoper', ldd sqlplus cannot find libsqlplus.so even though /app/oracle/lib is in LD_LIBRARY_PATH.
As a result the call to sqlplus fails when using 'cddsoper' account.
Why is that ?

Any help would be much appreciated.

thanks