From: chuck@edsi.plexus.COM (Chuck Tomasi)
Subject: Re: root access over NFS
Organization: Enterprise Data Systems Incorporated, Appleton WI
Date: Sun, 13 Sep 1992 22:20:31 GMT

andy@ie.utoronto.ca (Andy Sun) writes:

:)COMMANDS                               COMMENTS
:)----------------------------------     -------------------------------
:)# adb -w /hp-ux                        Run the absolute debugger with
:)executable file = /hp-ux                 the write option on the kernel
:)core file = core
:)ready

:)nobody?D                               Display 'nobody' in decimal
:)_nobody:    -2                         System's repsonse: its value is -2

:)nobody?W0                              Use a 4-byte write to change the
:)                                         contents of 'nobody' to 0
:)_nobody:    0xFFFFFFFE   =   0x0       System's response: its value is now 0

:)nobody?D                               Display (in decimal) the contents
:)                                         of 'nobody' to double-check
:)_nobody:    0                          System's response: its value is still 0

:)$q                                     Type '$q' to exit adb  


This patch (as noted) will only patch /hp-ux.  If you don't want to
reboot right away you should also patch the file /dev/kmem.  You can do
both at once with the command:

# adb -w /hp-ux /dev/kmem

If you have plans of regenerating a new kernel some day (adding device
drivers, modifying kernel parameters, etc) you'll have to do this all
over again.  I called HP and asked how I could make this more permanent
since I didn't want to patch the kernel after every iteration of a new
kernel.  They said they couldn't say (another unsupported feature.)  I
went ahead and hacked away and asked on the net.  I got the answer from
both about the same time, but you need to go into the directory
/etc/conf (on 400 systems) and /etc/conf/lib (on 700 systems) and use
the "ar" command to extract the file nfs_server.o from the library
archive libnfs.a.  This can be done with the command:

# ar xv libnfs.a nfs_server.o

Again, use adb in the same way as above to patch the file nfs_server.o
and put it back in the file libnfs.a with the command:

# ar uv libnfs.a nfs_server.o

Now every time you regenerate a new kernel you don't have to do the
patch since nobody is already set to 0 in the library that gets linked
in.  Pretty neat.

NOTE:  This is all from memory (especially the part about the 700
library).  My notes on this are at work and I'm writing this from home.
I apologize for the misplacement of directories or filenames, but it
should get you started in the right direction.

!!BIG NOTE!!  This is a security hole in your ENTIRE system since anyone
who gains root access can create, delete, and modify files on other
machines who have the kernel patch.  That is the primary reason HP
doesn't support this feature.

!! SUPER BIG NOTE !! If the whole thing blows up and you lose data - I
had nothing to do with it so don't call me.  :)
-- 
Chuck Tomasi             |     "It's my job to help
chuck@edsi.plexus.COM    |      but I don't have to like it."
spool!cserver!edsi!chuck |                    -Dr. Crusher, "I, Borg"
------<Enterprise Data Systems Incorporated, Appleton Wisconsin>------
Newsgroups: comp.sys.hp