Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

disk:[000000]security.sys file deleted :o(

Edwin R. van der Kaaij
Frequent Advisor

disk:[000000]security.sys file deleted :o(

Good Day!

We have a privileged DbA that has deleted the security.sys file off the top level of one of our user disks.

This is the definition:
Volume security profile: SECURITY.SYS
The volume security profile contains the volume's owner UIC, the volume protection mask, and its access control list.

We have run anal/disk/repair, but it did't re-create the file.

Can we expect problems? Can we recreate this file? What to do?

Greetings from Ed.
16 REPLIES
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

How did he do that ? On my system it's locked.

Wim
Wim
Edwin R. van der Kaaij
Frequent Advisor

Re: disk:[000000]security.sys file deleted :o(

Hello Wim,

That's a good question. I have no idea. He walked in this morning and reported that he deleted it. Maybe it wasn't locked here?

Fact is that it is not there now.

Greetings, Ed.
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Mmm mounted it wrongly. No lock but file protection forbids me. I'll search for it.

Wim
Wim
Karl Rohwedder
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Just made a test:
- the file is not opened
- but trying t delete always results in a 'insufficient priv' error, regardless of setting SET PROC/PRIV=ALL or SET SECURITY

What VMS version?
Have you treid to set some security related chars. of the volume, perhaps the file is recreated?

regards Kalle
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Found it.

set file/rem disk:[000000]security.sys

After that, gone.

Dismount disk. Mount disk. It's re-created.

So, remount.

Wim
Wim
Edwin R. van der Kaaij
Frequent Advisor

Re: disk:[000000]security.sys file deleted :o(

OpenVMS V7.3-2

Thanks for your suggestions!

I'll dismount/mount at a convenient time and report the final results/status here.

Ed.
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Only make sure the dba didn't take all blocks from the disk and that there is free space to create the file.

Wim
Wim
Edwin R. van der Kaaij
Frequent Advisor

Re: disk:[000000]security.sys file deleted :o(

Wim,

I found a system where it's possible to test this issue. I have tried many things, but there is NO way that i can delete the security.sys file. I even set myself as the owner, changed the protection, turned on all privileges etc, but cannot delete it.

I have the log of the delete (from DbA) in front of me. He did a del *.*;* at [000000] level. All files were denied access, but the security.sys file was gone.

Any more suggestions so i can test the remount?
Hein van den Heuvel
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Wim>> set file/rem disk:[000000]security.sys
Wim>> After that, gone.

Then ANAL/DISK would also recover it, and DFU and probably readily find it.

And if it was the first time, then you can just recreate a directory entry for file 10,10 using the attached program.

Wim>> Dismount disk. Mount disk. It's re-created.

Likely with a new file id. Again, try DFU?

Hint: Using a DECram, or LDdriver, disk it is realy easy to experiment with this without inconveniencing users.

Groetjes,
Hein.

/*
** enter.C create directory entry for a file ID.
**
** Have fun, Hein van den Heuvel, HP 6/4/2002
*/
#include ssdef
#include rms
#include stdio
#include string
#include stdlib

main(int argc, char *argv[])
{
int i, status, sys$parse(), sys$enter();
char *p, expanded_name[256], resultand_name[256];
struct FAB fab;
struct NAM nam;

if (argc < 4) {
printf ("Usage $%s [x] [x] \n", argv[0]);
return 268435456;
} else {

fab = cc$rms_fab;
fab.fab$l_fop = FAB$M_NAM;
fab.fab$l_dna = ".DAT";
fab.fab$b_dns = strlen(fab.fab$l_dna);
fab.fab$l_fna = argv[3];
fab.fab$b_fns = strlen (argv[3]);
fab.fab$l_nam = &nam;

nam = cc$rms_nam;
nam.nam$b_nop = NAM$M_NOCONCEAL;
nam.nam$l_rsa = resultand_name;
nam.nam$b_rss = 255;
nam.nam$l_esa = expanded_name;
nam.nam$b_ess = 255;


status = sys$parse( &fab );
if (status & 1) {
i = atoi (argv[1]);
nam.nam$w_fid_num = (short) i;
nam.nam$b_fid_nmx = (unsigned char) (i >> 16);
nam.nam$w_fid_seq = (short) atoi ( argv[2] );
status = sys$enter ( &fab );
}
return status;
}
}



Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Edwin,

I did a mount of the disk without /system.
Retried it and worked again. On VMS 6.2 1h3. Indeed anal/dis finds it back and puts it in [syslost] as Hein said. Check there too because maybe the dba used that command too.

I remounted it and found again the file recreated. If I do a diff between the 2 files they are not identical.

I've read that starting from VMS 6 the file is created at mount time. If create fails, mount fails.

Wim

Wim
Edwin R. van der Kaaij
Frequent Advisor

Re: disk:[000000]security.sys file deleted :o(

Hein, Wim,

Thank you both for your input!

I'm not getting any further though.
I do not have DFU available and cannot start using it just like that.
I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.
I have tried all kinds of (dis)mounts on the test system, but there is NO way that I get the file deleted. I created an a.a, removed it, found it back in [syslost] etc. but no luck with the security.sys file :o(

More later...
Hein van den Heuvel
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

>> I do not have DFU available and cannot start using it just like that.

Sure you can :-).
How can you efficiently manage an OpenVMS system without this Freeware?

>> I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.

I never tried cxx, just used 'cc'.

Or download an executable from:
http://h71000.www7.hp.com/freeware/freeware60/rms_tools/enter.exe

Edwin R. van der Kaaij
Frequent Advisor

Re: disk:[000000]security.sys file deleted :o(

don't have cc either :o) i tried that first haha. just downloaded the executable.

i'll try everything later, daily problems have stacked up, so i need to attend to them first.

thanks for all the suggestions.
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Did you use the statement
$ set file/remove disk:[000000]security.sys
to delete the file ? This should always work imo (Hein ?).

Wim
Wim
Volker Halle
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

Wim,


$ set file/remove disk:[000000]security.sys


A SET FILE/REMOVE command does NOT delete the file, it just removes its directory entry. The file still exists and is a so-called 'lost file', as there are no directory-entries pointing to it.

ANAL/DISK/REPAIR will put the file into [SYSLOST], from where you can rename it back to its original place.

Volker.
Wim Van den Wyngaert
Honored Contributor

Re: disk:[000000]security.sys file deleted :o(

I know that Volker.

But it's the only way to delete the open file for simulating the problem.

Wim
Wim