runacct error: Not owner

[Jim Walls]

I have recently commissioned several HP-UX 11.23 servers. They all suffer the same problem when the accounting script is run overnight. The accounting run appears to work correctly but produces two annoying messages that cause the cron to send an email.

Not owner
/var/adm/wtmps: Not owner

These come from the /usr/sbin/acct/runacct script. No other messages are emitted!

By turning on shell tracing, I see that the errors come from two underlying calls respectively:
closewtmp and utmp2wtmp

If /var/adm/wtmps is deleted, it is regenerated automatically if someone does a login.

ls -l /var/adm/wtmps
-rw-rw-r-- 1 adm adm 2608 Mar 27 14:04 /var/adm/wtmps

and the runacct script is run from the adm cron.

Any ideas about why this is happening?

[VK2COT]

Hello,

a) Who is the owner of directories

/var/adm/sa
/var/adm/acct

b) Who is the owner of directory /var/adm

c) Who is the owner of:

/var/adm/wtmp*

Cheers,

VK2COT

c)

[Jim Walls]

ls -ld /var/adm/sa /var/adm/acct /var/adm
drwxr-xr-x 17 adm adm 8192 Mar 27 18:50 /var/adm
drwxr-xr-x 5 adm adm 96 Oct 23 18:15 /var/adm/acct
drwxr-xr-x 2 adm adm 8192 Mar 27 00:00 /var/adm/sa

ls -l /var/adm/wtmp*
-rw-rw-r-- 1 adm adm 109500 Mar 27 18:57 /var/adm/wtmp
-rw-rw-r-- 1 adm adm 5868 Mar 27 18:57 /var/adm/wtmps
-rw-r--r-- 1 root sys 280 Mar 27 18:50 /var/adm/wtmpx

Please note, wtmpx has the same ownership and permissions on all our other HP-UX servers - that do not exhibit this problem.

Also, wtmps is new at HP-UX 11.23 - 11>11 does not use it.

[VK2COT]

Hello,

Typically, this error indicates an attempt
to modify a file in some way forbidden except
to its owner or the super-user, such as to
change its mode. It is also returned for
attempts by ordinary users to do things for
which they need, but lack, a special
privilege.

I would like to test setprivgrp(1) as
workaround.

Here is what I would like to try (cannot do
it before next week):

a) Login as root.

b) Create the file /etc/privgroup.

3) Add line "adm MLOCK" to file.

4) As root, run the command:

# setprivgrp -f /etc/privgroup

Or something similar to that.

Likewise we could use tusc(1) to
trace system calls in closewtmp
and utmp2wtmp. Maybe some of these
commands is executing chroot().

I tested your issue on two HP-UX 11.23
servers (running December 2007 patches).
I can confirm that I experienced the same
problems as you.

As you said, two commands cause it.
Here is the excerpt from the runacct
Shell script debug session:

...
+ test -r Spacct1.0328
+ mv pacct1 Spacct1.0328
+ test -r /var/adm/acct/nite/wtmp.0328
+ closewtmp
: Not owner
+ cp /var/adm/wtmps /var/adm/acct/nite/wtmp.0328
+ acctwtmp -X runacct
+ 1>> /var/adm/acct/nite/wtmp.0328
+ nulladm /var/adm/wtmps
+ utmp2wtmp
/var/adm/wtmps: Not owner
+ echo files setups complete
+ 1>> /var/adm/acct/nite/active
+ echo WTMPFIX
...

Maybe next week brings more sun.
It looks we might have hit some bug with
Unix system accounting under HP-UX 11.23.

Cheers,

VK2COT

[skt_skt]

sounds interesting..

[Jim Walls]

Thanks for the feedback,Dusan.

I came to a similar conclusion and decided to invoke our HP support contract... the HP technician asked for tusc output from closewtmp and utmp2wtmp. It will be interesting to hear what they come up with.

Jim.

[Dennis Handly]

>I see that the errors come from two underlying calls respectively:
closewtmp and utmp2wtmp

Have you compared the permissions on these two with your other systems? Are they SUID?

>Dusan: Likewise we could use tusc(1) to
trace system calls

Yes, that would show what file had the problem.

[Jim Walls]

>Have you compared the permissions on these two with your other systems? Are they SUID?

The files have identical permission as those on 11.11 systems - they are not SUID/SGID - but the file sizes and dates are different.