How do I assign Oracle user permissions on tape device?

[Dale Edmunds]

Hi,

Not being lazy - I've tried several searches and read a few articles - but I've so far failed to give the Oracle user on my system permission to write to the DLT8000. I've added the 'bin' group as a secondary group for the Oracle user (bin being the owner of devices in /dev/rmt), and have checked the permissions on /dev/rmt (755). But I still get a ERROR: Permission denied failure.

Is there anything I can do to assign the Oracle user permission to manipulate the tape device?

Cheers!

Dale

[Pete Randall]

Dale,

You shouldn't have to do anything to the device files. I would suspect that it's more likely the permissions on the command you're using to write with.


Pete

[Dale Edmunds]

Hi,

OK - that's interesting. I've tested the commands work (from a syntax point of view) -using root. And /usr/sbin is in my Oracle $PATH so it can find the 'mc' My syntax is:

TAPEDRIVE=/dev/rmt/6mn
LIBRARY=/dev/rac/c10t0d0
export LIBRARY TAPEDRIVE

DAY=`date | cut -c1-3`
export DAY

if [ $DAY = "Mon" ]
then
slotstatus=$(mc -r D | cut -c11-14)
if [ $slotstatus = "FULL" ]
then
emptyslot=$(mc -r S | grep "EMPTY" | cut -c9)
mc -s D1 -d S${emptyslot}
sleep 300
# Load tape 1 into drive
mc -s S1 -d D1
sleep 300
else
# Load tape 1 into drive
mc -s S1 -d D1
sleep 300
fi
fi

Not sure what left to try....

regards

Dale

[Dale Edmunds]

Well, even if I cd to /usr/sbin and try:

dekerp.oracle.TEST > : ./mc -r DS
ERROR: No such file or directory

dekerp.oracle.TEST > : ls -l mc
-r-xr-xr-x 1 bin bin 102400 Nov 9 2000 mc

Stumped!

Dale

[Geoff Wild]

first, though I don't think it will solve this, put the full path to mc in your script.

As root, does
/usr/sbin/mc -r DS
return anything?

On my workstation, I get "ERROR: No such file or directory" - but I don't have an autoloader...

Rgds...Geoff

[Dale Edmunds]

Hi Geoff,

Thanks for the help - and am happy to try anything. As root:

dekerp.root > : /usr/sbin/mc -r DS
DT_slot_1 EMPTY
ST_slot_1 EMPTY
ST_slot_2 FULL
ST_slot_3 EMPTY
ST_slot_4 EMPTY
ST_slot_5 EMPTY
ST_slot_6 EMPTY
ST_slot_7 FULL
ST_slot_8 FULL
ST_slot_9 FULL

but also :

dekerp.root > : mc -r DS
DT_slot_1 EMPTY
ST_slot_1 EMPTY
ST_slot_2 FULL
ST_slot_3 EMPTY
ST_slot_4 EMPTY
ST_slot_5 EMPTY
ST_slot_6 EMPTY
ST_slot_7 FULL
ST_slot_8 FULL
ST_slot_9 FULL

I'm 99% certain the issue for the Oracle user isn't finding the executable, but maybe 'mc' has sub-dependencies?

Regards

Dale

[Geoff Wild]

agreed - it's not the executable - it has something to do with the "default SCSI pass-through device"

What if you specify it (try with root and oracle):

/usr/sbin/mc -p /dev/rac/c10t0d0 -r DS

Or is it really:

/usr/sbin/mc -p /dev/rmt/6mn -r DS


Rgds...Geoff

[Steven E. Protter]

As root

insf -e

rebuild the device files.

oracle user should be able to create or read tapes as a default.

I think one of the device files probably got overwritten. I don't actually let oracle do this in practice, but can run a test on an obsolete box for you if you request.

SEP

[Dale Edmunds]

Hi,

Sorry for the delay - just completing some other task!

For Unix:

dekerp.root > : /usr/sbin/mc -p /dev/rac/c10t0d0 -r DS
DT_slot_1 EMPTY
ST_slot_1 FULL
ST_slot_2 FULL
ST_slot_3 FULL
ST_slot_4 FULL
ST_slot_5 FULL
ST_slot_6 FULL
ST_slot_7 FULL
ST_slot_8 FULL
ST_slot_9 FULL

For oracle:
dekerp.oracle.LIVE > : /usr/sbin/mc -p /dev/rac/c10t0d0 -r DS
ERROR: Permission denied

Regards

Dale

[Dale Edmunds]

Thanks SEP,

I've just run the insf -e on our DR Server (no risk), but can you tell me what the impact is of doing this on our Live server? Obviously I'm keen to not to do something that may cause a system crash/corruption or anything else!

If there is no impact I will run on Live and test the Oracle account and the DLT.

regards

Dale

[Geoff Wild]

What are the permissions on /dev/rac/c10t0d0?

[Dale Edmunds]

Geoff,

crw------- 1 bin sys 231 0x0a0000 Feb 26 2003 c10t0d0

HTH!

Dale

[Geoff Wild]

That might be the answer - I think it should be:

crw-rw-rw- 2 bin bin

Rgds...Geoff

[Pete Randall]

Dale,

Geoff's definitely right - that's why you're not getting permission as anyone other than root!


Pete

[Dale Edmunds]

Hi,

OK guys - your help is really appreciated. I have changed /dev/rac/c10t0d0 to have 755 permissions. Also changed the group to be 'bin':

dekerp.oracle.LIVE > : ls -ltr c10t0d0
crwxr-xr-x 1 bin bin 231 0x0a0000 Feb 26 2003 c10t0d0
dekerp.oracle.LIVE > : pwd
/dev/rac
dekerp.oracle.LIVE > :

But I still get the error:

dekerp.oracle.LIVE > : /usr/sbin/mc -p /dev/rac/c10t0d0 -r DS
ERROR: Permission denied

regards

Dale

[Bill Hassell]

The tape drive and the changer are totally separate. In order to write to the tape drive, like any other file, the device file must have write permission for the user. If the oracle user has bin group ownership and the tape drive permission/ownership is 664 root:bin, then any user with bin membership can write to the tape. Don't set the execute bit as it is meaningless for device files. Note: Verify that the oracle user has the additional group assigned by typing the id command.

Now the mc command has nothing to do with the tape drive (read/write and the mt command). It is a robotic changer and has it's own device file. But mc is a 1m command and located in /usr/sbin which is where the sysadmin commands are located. You'll need to add sudo to your system and give the oracle user the right to run mc.

[Dale Edmunds]

Hi,

Thanks again.

My Oracle user has the folowing set:

dekerp.oracle.LIVE > : id
uid=102(oracle) gid=102(dba) groups=2(bin)

The device settings (for my DLT) in /dev/rmt are:

crw-rw-rw- 2 bin bin 205 0x0a1040 Nov 9 16:00 6mn
crw-rw-rw- 2 bin bin 205 0x0a1040 Nov 9 16:00 c10t1d0BESTn

In /dev/rac:

dekerp.oracle.LIVE > : ls -l c10t0d0
crwxr-xr-x 1 bin bin 231 0x0a0000 Feb 26 2003 c10t0d0

Sorry to require spoon feeding, but when you mention adding sudo - what exactly is required? And how do I grant the Oracle user permission on /usr/sbin/mc. The mc executable is owned by bin:bin with r+x permissions. Isn't having bin group membership (secondary) enough to allow Oracle the use of the mc command?

Many thanks!

Dale

[Patrick Wallek · Accepted solution]

Instead of 755 on the /dev/rac/c?t?d?, I think it should be 666. Try that and see if it helps. I think that should solve your problem.

[Patrick Wallek]

You also need to make sure that write permissions on the tape device are appropriate (-rw-rw-rw-). You don't need execute on those, but you need write if you want anyone to be able to write to the device.

[Dale Edmunds]

Patrick,

Now I am smiling!

dekerp.oracle.LIVE > : /usr/sbin/mc -p /dev/rac/c10t0d0 -r DS
DT_slot_1 EMPTY
ST_slot_1 FULL
ST_slot_2 FULL
ST_slot_3 FULL
ST_slot_4 FULL
ST_slot_5 FULL
ST_slot_6 FULL
ST_slot_7 FULL
ST_slot_8 FULL
ST_slot_9 FULL

So, just to recap for any other user who may have a similar issue: was this problem simply an error in the /dev/rac/c10t0d0 permissions? Or have all other steps been required?

regards

Dale

[Patrick Wallek]

Most likely the main problem was a permissions issue on /dev/rac/c10t0d0. They were initially -rw------- which will only allow the owner of the file or root to do anything. Changing the permissions to -rw-rw-rw- allows anyone to work with the device.

I'm not so sure that's a good idea, but if it is required in your environment, then that's the way it has to be.

[Dale Edmunds]

I think the tape device permissions are fine, I assume you're referring to the device in /dev/rmt?

I will assign points in the morning. I want to re-read everyone's very helpful and appreciated input - I would NEVER have resolved this without your help. Virtual beers all round.

The only direct access to the server is by myself and another administrator, so the risk of having the tape device 'opened up' is considered small. If I could lock it down to just root and Oracle I would - but I can't. This is the culmination in a very long list of issues I have found (the Hot Backup doesn't work for example) so I'm having to redo lots of things from scratch, with the limited knowledge and tools I have on the HP-UX side of things. So as there's an urgency for getting a new tried and tested Hot Backup in place (as you can imagine!) it's easier for me to open the tape device up and deploy scripts I know and trust.

Thanks for all your help - one and all.

regards

Dale

[Patrick Wallek]

Yes, the tape device file I am referring to are the ones in the /dev/rmt/ directory and need to be -rw-rw-rw- as well.