disk:[000000]security.sys file deleted :o(

[Edwin R. van der Kaaij]

Good Day!

We have a privileged DbA that has deleted the security.sys file off the top level of one of our user disks.

This is the definition:
Volume security profile: SECURITY.SYS
The volume security profile contains the volume's owner UIC, the volume protection mask, and its access control list.

We have run anal/disk/repair, but it did't re-create the file.

Can we expect problems? Can we recreate this file? What to do?

Greetings from Ed.

[Wim Van den Wyngaert]

How did he do that ? On my system it's locked.

Wim

[Edwin R. van der Kaaij]

Hello Wim,

That's a good question. I have no idea. He walked in this morning and reported that he deleted it. Maybe it wasn't locked here?

Fact is that it is not there now.

Greetings, Ed.

[Wim Van den Wyngaert]

Mmm mounted it wrongly. No lock but file protection forbids me. I'll search for it.

Wim

[Karl Rohwedder]

Just made a test:
- the file is not opened
- but trying t delete always results in a 'insufficient priv' error, regardless of setting SET PROC/PRIV=ALL or SET SECURITY

What VMS version?
Have you treid to set some security related chars. of the volume, perhaps the file is recreated?

regards Kalle

[Wim Van den Wyngaert]

Found it.

set file/rem disk:[000000]security.sys

After that, gone.

Dismount disk. Mount disk. It's re-created.

So, remount.

Wim

[Edwin R. van der Kaaij]

OpenVMS V7.3-2

Thanks for your suggestions!

I'll dismount/mount at a convenient time and report the final results/status here.

Ed.

[Wim Van den Wyngaert]

Only make sure the dba didn't take all blocks from the disk and that there is free space to create the file.

Wim

[Edwin R. van der Kaaij]

Wim,

I found a system where it's possible to test this issue. I have tried many things, but there is NO way that i can delete the security.sys file. I even set myself as the owner, changed the protection, turned on all privileges etc, but cannot delete it.

I have the log of the delete (from DbA) in front of me. He did a del *.*;* at [000000] level. All files were denied access, but the security.sys file was gone.

Any more suggestions so i can test the remount?

[Hein van den Heuvel]

Wim>> set file/rem disk:[000000]security.sys
Wim>> After that, gone.

Then ANAL/DISK would also recover it, and DFU and probably readily find it.

And if it was the first time, then you can just recreate a directory entry for file 10,10 using the attached program.

Wim>> Dismount disk. Mount disk. It's re-created.

Likely with a new file id. Again, try DFU?

Hint: Using a DECram, or LDdriver, disk it is realy easy to experiment with this without inconveniencing users.

Groetjes,
Hein.

/*
** enter.C create directory entry for a file ID.
**
** Have fun, Hein van den Heuvel, HP 6/4/2002
*/
#include ssdef
#include rms
#include stdio
#include string
#include stdlib

main(int argc, char *argv[])
{
int i, status, sys$parse(), sys$enter();
char *p, expanded_name[256], resultand_name[256];
struct FAB fab;
struct NAM nam;

if (argc < 4) {
printf ("Usage $%s [x] [x] \n", argv[0]);
return 268435456;
} else {

fab = cc$rms_fab;
fab.fab$l_fop = FAB$M_NAM;
fab.fab$l_dna = ".DAT";
fab.fab$b_dns = strlen(fab.fab$l_dna);
fab.fab$l_fna = argv[3];
fab.fab$b_fns = strlen (argv[3]);
fab.fab$l_nam = &nam;

nam = cc$rms_nam;
nam.nam$b_nop = NAM$M_NOCONCEAL;
nam.nam$l_rsa = resultand_name;
nam.nam$b_rss = 255;
nam.nam$l_esa = expanded_name;
nam.nam$b_ess = 255;


status = sys$parse( &fab );
if (status & 1) {
i = atoi (argv[1]);
nam.nam$w_fid_num = (short) i;
nam.nam$b_fid_nmx = (unsigned char) (i >> 16);
nam.nam$w_fid_seq = (short) atoi ( argv[2] );
status = sys$enter ( &fab );
}
return status;
}
}