Wednesday, January 28, 2015

Solaris: ps command truncating at 80 characters


Last week I got an issue where the application team raised the concern that "ps" command output truncated at 80 characters. They are trying to write a script that will find particular process based in a keyword. But due to the truncated "ps" command, they couldn't search the keyword. they request us(unix) to check that. Earlier I thought we can fix it easily, but later on when I dig into it, I found some more details and hurdles. finally, I got a solution and recommended the same to them. I just want to share those details in this post.
  • /usr/bin/ps  Deafult ps option of SVR4 (System V Release 4)
  • /usr/ucb/ps  BSD style options (ucb means University of California, Berkeley
    root@unixrock# ls -li /usr/bin/ps /usr/ucb/ps
    834 -r-xr-xr-x 66 root bin 5816 Jan 8 2007 /usr/bin/ps
    834 -r-xr-xr-x 66 root bin 5816 Jan 8 2007 /usr/ucb/ps
    root@unixrock#
    root@unixrock# ldd /usr/bin/ps /usr/ucb/ps
    /usr/bin/ps:
    libc.so.1 => /lib/libc.so.1
    libm.so.2 => /lib/libm.so.2
    /usr/ucb/ps:
    libc.so.1 => /lib/libc.so.1
    libm.so.2 => /lib/libm.so.2
    root@unixrock#

"psadmin" is the application user who is required full output of the process on "ps" command where they can see only first 80 characters. they also tried "/usr/ucb/ps auxwww" but same output. below output "psadmin" user can only seeing first 80 characters of PID 944.
psadmin@unixrock$ uname -a
SunOS unixrock 5.10 Generic_142910-17 i86pc i386 i86pc
psadmin@unixrock$
psadmin@unixrock$ id
uid=100(psadmin) gid=1(other)
psadmin@unixrock$
psadmin@unixrock$ /usr/ucb/ps auxwww|grep -i 944|grep -v grep
USER PID %CPU %MEM SZ RSS TT S START TIME COMMAND
noaccess 944 0.3 7.7133876119764 ? S 02:11:22 3:28 /usr/java/bin/java -server -Xmx128m -XX:+UseParallelGC -XX:ParallelGCThreads=4
psadmin@unixrock$

when we checked as root user, it is working fine as expected. But as normal user account can't do the same.

root@unixrock#
root@unixrock# /usr/ucb/ps auxwww|grep -i 944|grep -v grep
noaccess 944 0.3 7.7133876119764 ? S 02:11:22 3:29 /usr/java/bin/java -server -Xmx128m -XX:+UseParallelGC -XX:ParallelGCThreads=4 -classpath /usr/share/webconsole/private/container/bin/bootstrap.jar:/usr/share/webconsole/private/container/bin/commons-logging.jar:/usr/share/webconsole/private/container/bin/log4j.jar:/usr/java/lib/tools.jar:/usr/java/jre/lib/jsse.jar -Djava.security.manager -Djava.security.policy==/var/webconsole/domains/console/conf/console.policy -Djavax.net.ssl.trustStore=/var/webconsole/domains/console/conf/keystore.jks -Djava.security.auth.login.config=/var/webconsole/domains/console/conf/consolelogin.conf -Dcatalina.home=/usr/share/webconsole/private/container -Dcatalina.base=/var/webconsole/domains/console -Dcom.sun.web.console.home=/usr/share/webconsole -Dcom.sun.web.console.conf=/etc/webconsole/console -Dcom.sun.web.console.base=/var/webconsole/domains/console -Dcom.sun.web.console.logdir=/var/log/webconsole/console -Dcom.sun.web.console.native=/usr/lib/webconsole -Dcom.sun.web.console.appbase=/var/webconsole/domains/console/webapps -Dcom.sun.web.console.secureport=6789 -Dcom.sun.web.console.unsecureport=6788 -Dcom.sun.web.console.unsecurehost=127.0.0.1 -Dwebconsole.default.file=/etc/webconsole/console/default.properties -Dwebconsole.config.file=/etc/webconsole/console/service.properties -Dcom.sun.web.console.startfile=/var/webconsole/tmp/console_start.tmp -Djava.awt.headless=true -Dorg.apache.commons.logging.Log=org.apache.commons.logging.impl.NoOpLog org.apache.catalina.startup.Bootstrap start
root 178 0.0 0.2 7112 2944 ? S 02:09:39 0:04 /usr/sbin/nscd
root 476 0.0 0.1 2072 944 ? S 02:10:10 0:00 /usr/sadm/lib/smc/bin/smcboot
root@unixrock#
root@unixrock#
root@unixrock# ps -ef|grep -i 944|grep -v grep
noaccess 944 1 0 02:11:23 ? 3:29 /usr/java/bin/java -server -Xmx128m -XX:+UseParallelGC -XX:ParallelGCThreads=4
root@unixrock#

we tried to set setuid (chmod u+s /usr/ucb/ps) to the executable file "/usr/ucb/ps", its works fine even executed by as a normal user, But its causes the impact for other applications which is looking for the same executable. Our requirements should be achieve without changing the current permissions. We tried SUDO, ACL privilege too, but no use, same conditions only.

root@unixrock# ls -ltr /usr/ucb/ps
-r-xr-xr-x 66 root bin 5816 Jan 8 2007 /usr/ucb/ps
root@unixrock#
root@unixrock# getfacl /usr/ucb/ps

 
# file: /usr/ucb/ps
# owner: root
# group: bin
user::r-x
group::r-x #effective:r-x
mask:r-x
other:r-x
root@unixrock#

when I dig more, I found the path through RBAC (Role based access control). Here is the steps to achieve our requirements. Our change plan would be Create Profile --> Privilege to profile --> Creating Role --> Role to profile --> Role to user
For more about RBAC
Creating a profile by appending the below line on /etc/security/prof_attr and Ctrl+d for save the changes.


root@unixrock# cp -p /etc/security/prof_attr /etc/security/prof_attr_backup
root@unixrock#
root@unixrock# cat >>/etc/security/prof_attr
psquery:::Processes Query as Root:
root@unixrock#

Privilege to profile by appending the below line on /etc/security/exec_attr and Ctrl+d for save the changes.

root@unixrock# cp -p /etc/security/exec_attr /etc/security/exec_attr_backup
root@unixrock#
root@unixrock#cat >>/etc/security/exec_attr
psquery:suser:cmd:::/usr/ucb/ps:privs=proc_owner;uid=0;euid=0;gid=0;egid=0
root@unixrock#

Creating Role 

root@unixrock# roleadd -d /export/home/Rpsadmin -m Rpsadmin
root@unixrock# passwd Rpsadmin
New Password:
Re-enter new Password:
passwd: password successfully changed for Rpsadmin
root@unixrock#

Role to profile 

root@unixrock# rolemod -P "psquery" Rpsadmin
root@unixrock#
root@unixrock# cat /etc/user_attr |grep -i psadmin
Rpsadmin::::type=role;profiles=psquery
root@unixrock#

Role to user 

root@unixrock# usermod -R Rpsadmin psadmin
root@unixrock#
root@unixrock# cat /etc/user_attr |grep -i psadmin
Rpsadmin::::type=role;profiles=psquery
psadmin::::type=normal;roles=Rpsadmin
root@unixrock#

Checking the status.. 

root@unixrock# su - psadmin
Oracle Corporation SunOS 5.10 Generic Patch January 2005
$
$ id
uid=100(psadmin) gid=1(other)
$ su - Rpsadmin
Password:
$
$ id
uid=101(Rpsadmin) gid=1(other)
$
$ /usr/ucb/ps auxwww|grep -i 944|grep -v grep
noaccess 944 0.4 7.7133876119764 ? S 02:11:22 3:32 /usr/java/bin/java -server -Xmx128m -XX:+UseParallelGC -XX:ParallelGCThreads=4 -classpath /usr/share/webconsole/private/container/bin/bootstrap.jar:/usr/share/webconsole/private/container/bin/commons-logging.jar:/usr/share/webconsole/private/container/bin/log4j.jar:/usr/java/lib/tools.jar:/usr/java/jre/lib/jsse.jar -Djava.security.manager -Djava.security.policy==/var/webconsole/domains/console/conf/console.policy -Djavax.net.ssl.trustStore=/var/webconsole/domains/console/conf/keystore.jks -Djava.security.auth.login.config=/var/webconsole/domains/console/conf/consolelogin.conf -Dcatalina.home=/usr/share/webconsole/private/container -Dcatalina.base=/var/webconsole/domains/console -Dcom.sun.web.console.home=/usr/share/webconsole -Dcom.sun.web.console.conf=/etc/webconsole/console -Dcom.sun.web.console.base=/var/webconsole/domains/console -Dcom.sun.web.console.logdir=/var/log/webconsole/console -Dcom.sun.web.console.native=/usr/lib/webconsole -Dcom.sun.web.console.appbase=/var/webconsole/domains/console/webapps -Dcom.sun.web.console.secureport=6789 -Dcom.sun.web.console.unsecureport=6788 -Dcom.sun.web.console.unsecurehost=127.0.0.1 -Dwebconsole.default.file=/etc/webconsole/console/default.properties -Dwebconsole.config.file=/etc/webconsole/console/service.properties -Dcom.sun.web.console.startfile=/var/webconsole/tmp/console_start.tmp -Djava.awt.headless=true -Dorg.apache.commons.logging.Log=org.apache.commons.logging.impl.NoOpLog org.apache.catalina.startup.Bootstrap start
root 178 0.2 0.2 7112 2944 ? S 02:09:39 0:04 /usr/sbin/nscd
root 476 0.0 0.1 2072 944 ? S 02:10:10 0:00 /usr/sadm/lib/smc/bin/smcboot
$

Cool..!!!..We have done with RBAC.
I hope this post helps you, Please share your valuable comments or queries and like the page. 

No comments:

Post a Comment