<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">Patch-ID# 104829-01
Keywords: lit CERT security license FLEXlm SUNWlicsw, SUNWlit
Synopsis: FLEXlm 4.1: Licensing patch for Solaris 2.x
Date: May/13/97

Solaris Release: 2.4 2.5 2.5.1

SunOS Release: 5.4 5.5 5.5.1

Unbundled Product: FLEXlm

Unbundled Release: 4.1c

Relevant Architectures: sparc

BugId's fixed with this patch: 1263755 4028378 4010037 4012897 4042585 4037251

Changes incorporated in this version: 1263755 4028378 4010037 4012897 4042585 4037251

Patches accumulated and obsoleted by this patch: 104174-02

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

Files modified or new to the SUNWlicsw package including:
/etc/init.d/lic_mgr
/etc/opt/licenses/lic_srvr_start 
/etc/opt/licenses/adjust_flexlm_owner 

Files modified or new to the SUNWlit package including:
SUNWste/license_tools/config_template
SUNWste/license_tools/lit


Problem Description: 

4010037 Fixes problem on Solaris 2.4 machines causing newline
characters to not be interpreted correctly on all text messages
produced by lit.

4012897 Fixes problem where lit is unable to find Japanese font in the
ja locale.

4042585 Fixes problem where lit is unable to find message catalog
files due to an error in setting NLSPATH.

4037251 Fixes problem where Help button on lit file chooser dialog
that caused core dumps.

4028378 Fixes problem encountered when installing the patch on Solaris
2.4 systems.  Only SUNWlicsw has been modified for Rev 2.

1263755 Prior to the patch, root was used to start and own the license
daemon, lmgrd.ste, and the license managing software.  This patch
enables a valid non-privileged username to start the license server
daemon, lmgrd.ste, and use the utilities of the license managing
software.  If root is used, there is a potential security risk that
can be abused on UNIX systems.  This has been pointed out in a CERT
security advisory.


Patch Installation Instructions: 
-------------------------------- 
Refer to the Install.info file for instructions on using the
generic 'installpatch' and 'backoutpatch' scripts provided with
each patch.  Any other special or non-generic installation
instructions should be described below as special instructions.

Special Install Instructions: 
-----------------------------
If you have patch 104174-01 or 104174-02 installed, you must manually
remove it before installing patch 104829-01.  To remove patch
104174-0[1 or 2], become root on the target machine and issue the
commands:
        # cd /var/sadm/patch
        # 104174-0*/backoutpatch 104174-0*

(* is either 1 or 2)

Version 4.2 of the SUNWlicsw package must first be installed on the
license server.

To verify the version of SUNWlicsw on Solaris 2.x, issue the pkginfo
command.  The following example is for a license server which has had
two different versions of the SUNWlicsw package installed and no
versions of the SUNWlicsw package removed.

% pkginfo | grep SUNWlicsw
application SUNWlicsw      FlexLM License System
application SUNWlicsw.2    FlexLM License System

Invoke pkginfo again using the latest (highest package number)
installed version of SUNWlicsw and look at the value in the VERSION
field.

% pkginfo -l SUNWlicsw.2
   PKGINST:  SUNWlicsw
      NAME:  FlexLM License System
  CATEGORY:  application
      ARCH:  sparc
   VERSION:  4.2
   ...

If you do not have version 4.2 of the SUNWlicsw package, it is
available from the Sun WorkShop CD labelled "Sun WorkShop for Solaris
2.x Volume 5,Number 1" or from the Sun WorkShop TryandBuy Web page at
http://www.sun.com/workshop/ .

When installpatch is run, scripts in SUNWlicsw will look for the file,
/etc/opt/licenses/flexlm_owner.  If this file is not found, the
license server daemon, installed with SUNWlicsw, will be configured to
run owned by the username nobody.  After the patch is installed, this
configuration can be changed at anytime by using the script,
adjust_flexlm_owner (see below).

To create the file, /etc/opt/licenses/flexlm_owner, use any
editor and create the file to contain a single valid non-privileged
username that will be used by root when starting the license
daemon.  There should only be a single line in this file containing
the username.  Do not include any leading or trailing blank spaces.

A valid non-privileged username is requested for use in starting
the license server daemon, lmgrd.ste.  As in the past, root may
still be used but it is highly discouraged.  If root is used, there
is a potential security risk that can be abused on UNIX systems.
Once a valid username is entered, the group that the license manager
software belongs to will be updated with that of the group that
username belongs to.  The permissions on these files will also be
updated to allow group read and execute privileges so that "username"
can use them.  The license manager startup script, /etc/rc2.d/S85lmgrd,
will be modified to start the license daemon as "username" even though
S85lmgrd is still executed as root.

If you wish to limit access to the license manager daemon, you can
set up a non-privileged account specifically for this purpose. For
example the account "flexlm" can be created.  If you want to use
a username such as "flexlm" that currently does not exist you must
first create the user before running installpatch because the username
entered in the file will be checked to ensure that it is a valid
username on your system.

After this patch has been correctly installed, there will be a new
script in /etc/opt/licenses called adjust_flexlm_owner.  This script
can be run anytime by root to change the username used to start
the licensing daemon.  The script provides online help.  NOTE: The
script will run non-interactively if the file 
/etc/opt/licenses/flexlm_owner exists.  To run the script
interactively, first delete the flexlm_owner file.
</pre></body></html>