TRANSLATED image install problem

[Joe Gadsby]

Hi

I translated (AEST) an ALPHA software package, RS/1, to run on my Integrity server. It runs only if I give the user account SYSLCK priv. On the ALPHA, this was installed with this priv. I install it on the I64 and remove the priv from the account. I get this message ...
PROMB4->rs1
%DCL-W-ACTIMAGE, error activating image JKT$DECC_RTL_AXP_AV-CLI-E-IMGNAME, image file PROMB4$DKA7:[SYS0.SYSCOMMON.][SYSLIB]JKT$DECC_RTL_AXP_AV.EXE;1
-SYSTEM-F-PRIVINSTALL, shareable images must be installed to run privileged image
........
When I try to install this, I get .
...
%INSTALL-E-FAIL, failed to CREATE entry for DISK$I64_V831H1:
JKT$DECC_RTL_AXP_AV.EXE
-INSTALL-E-IMGTRACED, /TRACEBACK image cannot be a privileged, execute_only, or resident image


Any thoughts ? Is it a danger to give out SYSLCK to a handful of users ?

Thanks !

-jg-

[Hoff]

The Brooks Reticle Stocker stuff? That's targeting HP-UX now, apparently. But you know that.

As for your question? Passing out SYSLCK to a handful of users? No. Pass it out.

[Paul Jerrom · Accepted solution]

All installed privileged images need to be linked /NOTRACEBACK. Otherwise the theory is that you can Y a running privileged image, type DEBUG and there you are with a logged in session with the elevated privilege.

I don't know anything about AEST, but does it have the ability to create a /NOTRACEBACK image?

This is the same on Alpha and IA64, sothe Alpha image must be /NOTRACEBACK, so I'd assume (:-0) an IA64 translated version would be also...

Have fun
PJ

[Tim E. Sneddon]

Paul Jerrom is correct regarding the use of /TRACEBACK. However, it's not the translated image that is the problem. It is the supporting TIE RTL images.

I've noticed you've asked a couple questions about AEST and the TIE. I am the current maintainer of both software packages (no, I do not work directly for HP). If you're interested in some help getting your software up and running, you can contact me at tim.sneddon[at]bigpond.com.

Tim.

[John Gillings]

Joe,

OpenVMS V8 and above has the SET IMAGE command to turn things like DEBUG and TRACEBACK on and off. If AEST doesn't have a direct mechanism to generate a NOTRACEBACK image, try:

$ SET IMAGE/FLAGS=(NOTBK_IN_IMG) JKT$DECC_RTL_AXP_AV.EXE

If that doesn't work have a look at HELP SET IMAGE/FLAGS for other possibilities.

[H.Becker]

>>>
$ SET IMAGE/FLAGS=(NOTBK_IN_IMG) JKT$DECC_RTL_AXP_AV.EXE
<<<

That will not work. Because of a)

%SET-E-NOTSET, image attributes not changed
-SET-F-OPNOTALLOWED, operation not allowed on translated images

and b) you need to set NOIMGSTA to get rid of the "/trace", no matter if you have traceback records in the image or in a dsf.

[Hoff]

Passing out SYSLCK to a few users is a whole lot easier than messing about with patching and installing a translated image.

As privileges go, SYSLCK is not a particular risk for a handful of users in a controlled environment.

Would SYSLCK be passed out to everybody logged in over on the Deathrow cluster? No.

There's no path to privilege escalation via SYSLCK. (That's why it's a system-class privilege and not an all-class.)

Yes, you can mess up a system with errant system locks. That's why it's system-class, and why it could cause stability problems over on Deathrow. But there are (many) other ways to mess up a system.

Here? Pass it out to the handful of users, and move on.

[Joe Gadsby]

Hi

What an amazing bunch ! I wish I could share beers with all !

Thanks for all the feedback/suggestions/sounding-board stuff.

I finally convinced management that giving a few, (6), users SYSLCK priv, while in a monitored account, was easier than paying to have this re-written, was the way to go.

(I really love the "That is not an option" response.) Points to follow ! Thanks !

[Joe Gadsby]

Ummm, "that is not an option" from management.... I meant.

-jg-

[Joe Gadsby]

I just gave the users (6) syslck and there I was.