Help to enchance unix tool..

UNIX for Advanced & Expert Users
1

HI friends ,

I was assigned to enhance tool in unix solaris...the tool is totaly developed on shell and perl scripts...

The tool is used to change control files....The users are of certain group..
due to many users some people are changing these control files directly by using editors ....they are not using tool to change control files.

In the tool it has feature that it will not allow multiple user to write at a time.
But other user can change by using editors ...So we need to stop this...

Please help me in this regard....

I thought file locking...but dont know how to implement...:confused:

2

here is a good starter for you

3

Sorry yaar sawant i have tried but its not working..still the file open with editor.

4

From the link above...

If a program does not care about locks it will not abide by them. Locks are an afterthought in UNIX, not fundamental like in Windows NT.

5

you probably need make use of fcntl

for example, if you are using Perl, then refer to this

6

But they don't stop user "joe" using editor "fred" to edit a file and ignore the locks.

7

is there any way to stop changing the file using editors...except

permissions...

8

Some operating systems support Access Control Lists but they are really glorified permissions, it won't solve your requirement.

9

in my opinion, you need to tell all people not to edit those files directly, and provide them access to your tools using which they can do the required editing (if your tools are good enough, then they may quit their old habits and start using the tools)

if you are going ahead with fcntl, this is a good place to visit

10

Since mandatory file locking in *nix is somewhat, well, borked , you could use the common kludge of an independent lockfile for exclusive access per file. The trick there is
making bulletproof the removal of the same based on client behavior, implementing a timed wait, etc..Not impossible, but challenging.

11

Could some lateral thinking work?

Perhaps you could save the file encrypted, so that editing it has to be a 2-stage process.
Of course, your would have to decrypt it for use too.

Alternatively, you could secure the file so it could not be edited, and then use sudo to access it.
If you did a wrapper on the front, then that could take care of locking.

Another option would be to use NFS to share the file, and then mount it back with extra controls.

Or perhaps you could make the control files binary, so that they need a front-end of your choice to edit.

Or maybe a version control system (eg. RCS) could be used to check in and out the file.

But at the end of the day, essentially you've got a security situation - directory and file permissions should be set so that only designated and authorised persons have access to (view/edit) files, and anything that circumvents this is badly designed and/or implemented.