topic Re: disk:[000000]security.sys file deleted :o( in Operating System - OpenVMS

disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 03:13:01 GMT

Good Day!

We have a privileged DbA that has deleted the security.sys file off the top level of one of our user disks.

This is the definition:
Volume security profile: SECURITY.SYS
The volume security profile contains the volume's owner UIC, the volume protection mask, and its access control list.

We have run anal/disk/repair, but it did't re-create the file.

Can we expect problems? Can we recreate this file? What to do?

Greetings from Ed.

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 03:30:42 GMT

How did he do that ? On my system it's locked.

Wim

Re: disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 03:34:11 GMT

Hello Wim,

That's a good question. I have no idea. He walked in this morning and reported that he deleted it. Maybe it wasn't locked here?

Fact is that it is not there now.

Greetings, Ed.

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 03:35:33 GMT

Mmm mounted it wrongly. No lock but file protection forbids me. I'll search for it.

Wim

Re: disk:[000000]security.sys file deleted :o(

Karl Rohwedder — Mon, 28 Aug 2006 03:36:42 GMT

Just made a test:
- the file is not opened
- but trying t delete always results in a 'insufficient priv' error, regardless of setting SET PROC/PRIV=ALL or SET SECURITY

What VMS version?
Have you treid to set some security related chars. of the volume, perhaps the file is recreated?

regards Kalle

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 03:38:31 GMT

Found it.

set file/rem disk:[000000]security.sys

After that, gone.

Dismount disk. Mount disk. It's re-created.

So, remount.

Wim

Re: disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 03:43:22 GMT

OpenVMS V7.3-2

Thanks for your suggestions!

I'll dismount/mount at a convenient time and report the final results/status here.

Ed.

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 03:45:24 GMT

Only make sure the dba didn't take all blocks from the disk and that there is free space to create the file.

Wim

Re: disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 06:19:14 GMT

Wim,

I found a system where it's possible to test this issue. I have tried many things, but there is NO way that i can delete the security.sys file. I even set myself as the owner, changed the protection, turned on all privileges etc, but cannot delete it.

I have the log of the delete (from DbA) in front of me. He did a del *.*;* at [000000] level. All files were denied access, but the security.sys file was gone.

Any more suggestions so i can test the remount?

Re: disk:[000000]security.sys file deleted :o(

Hein van den Heuvel — Mon, 28 Aug 2006 06:25:04 GMT

Wim>> set file/rem disk:[000000]security.sys
Wim>> After that, gone.

Then ANAL/DISK would also recover it, and DFU and probably readily find it.

And if it was the first time, then you can just recreate a directory entry for file 10,10 using the attached program.

Wim>> Dismount disk. Mount disk. It's re-created.

Likely with a new file id. Again, try DFU?

Hint: Using a DECram, or LDdriver, disk it is realy easy to experiment with this without inconveniencing users.

Groetjes,
Hein.

/*
** enter.C create directory entry for a file ID.
**
** Have fun, Hein van den Heuvel, HP 6/4/2002
*/
#include ssdef
#include rms
#include stdio
#include string
#include stdlib

main(int argc, char *argv[])
{
int i, status, sys$parse(), sys$enter();
char *p, expanded_name[256], resultand_name[256];
struct FAB fab;
struct NAM nam;

if (argc < 4) {
printf ("Usage $%s [x] [x]

\n", argv[0]);
return 268435456;
} else {

fab = cc$rms_fab;
fab.fab$l_fop = FAB$M_NAM;
fab.fab$l_dna = ".DAT";
fab.fab$b_dns = strlen(fab.fab$l_dna);
fab.fab$l_fna = argv[3];
fab.fab$b_fns = strlen (argv[3]);
fab.fab$l_nam = &nam;

nam = cc$rms_nam;
nam.nam$b_nop = NAM$M_NOCONCEAL;
nam.nam$l_rsa = resultand_name;
nam.nam$b_rss = 255;
nam.nam$l_esa = expanded_name;
nam.nam$b_ess = 255;

status = sys$parse( &fab );
if (status & 1) {
i = atoi (argv[1]);
nam.nam$w_fid_num = (short) i;
nam.nam$b_fid_nmx = (unsigned char) (i >> 16);
nam.nam$w_fid_seq = (short) atoi ( argv[2] );
status = sys$enter ( &fab );
}
return status;
}
}

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 06:41:30 GMT

Edwin,

I did a mount of the disk without /system.
Retried it and worked again. On VMS 6.2 1h3. Indeed anal/dis finds it back and puts it in [syslost] as Hein said. Check there too because maybe the dba used that command too.

I remounted it and found again the file recreated. If I do a diff between the 2 files they are not identical.

I've read that starting from VMS 6 the file is created at mount time. If create fails, mount fails.

Wim

Re: disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 07:25:21 GMT

Hein, Wim,

Thank you both for your input!

I'm not getting any further though.
I do not have DFU available and cannot start using it just like that.
I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.
I have tried all kinds of (dis)mounts on the test system, but there is NO way that I get the file deleted. I created an a.a, removed it, found it back in [syslost] etc. but no luck with the security.sys file :o(

More later...

Re: disk:[000000]security.sys file deleted :o(

Hein van den Heuvel — Mon, 28 Aug 2006 07:34:40 GMT

>> I do not have DFU available and cannot start using it just like that.

Sure you can :-).
How can you efficiently manage an OpenVMS system without this Freeware?

>> I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.

I never tried cxx, just used 'cc'.

Or download an executable from:
http://h71000.www7.hp.com/freeware/freeware60/rms_tools/enter.exe

Re: disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij — Mon, 28 Aug 2006 08:01:27 GMT

don't have cc either :o) i tried that first haha. just downloaded the executable.

i'll try everything later, daily problems have stacked up, so i need to attend to them first.

thanks for all the suggestions.

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 08:26:05 GMT

Did you use the statement
$ set file/remove disk:[000000]security.sys
to delete the file ? This should always work imo (Hein ?).

Wim

Re: disk:[000000]security.sys file deleted :o(

Volker Halle — Mon, 28 Aug 2006 10:34:38 GMT

Wim,

$ set file/remove disk:[000000]security.sys

A SET FILE/REMOVE command does NOT delete the file, it just removes its directory entry. The file still exists and is a so-called 'lost file', as there are no directory-entries pointing to it.

ANAL/DISK/REPAIR will put the file into [SYSLOST], from where you can rename it back to its original place.

Volker.

Re: disk:[000000]security.sys file deleted :o(

Wim Van den Wyngaert — Mon, 28 Aug 2006 10:45:36 GMT

I know that Volker.

But it's the only way to delete the open file for simulating the problem.

Wim