How to make one user has READ ONLY access to all "oracle" files?

[yyghp]

One user asked to have READ ONLY access to ALL oralce directories/files, which are owned by "oracle:oinstall". I can't let this user use "oracle" account, and I can't add the user into "oinstall", and "oracle" directories and files are all over the filesystem, most of them are like "-rwxr-x---" or "-rw-r-----", it's not good to "chmod" all of them to "o+rx" for directories, and "o+r" for files, because I don't want other users to read those dirs/files.
So, any suggestion for this issue?
Thanks a lot!

[Pete Randall]

Can you make him part of the group "oinstall"? If not, then you would have to set something up with sudo, I guess.


Pete

[yyghp]

no, i can't add the user into "oinstall" group.

[john korterman]

Hi,

one way would be to assign the user to the necessary groups and then let himself change to the relevant group by "newgrp" when necessary. However, if you do not want to assign him to oinstall in the first place, this limits the possibilities, but if files in group oinstall have read permission for "others" you might still be able to puzzle something together by assigning the user to different secondary groups.

regards,
John K

[A. Clay Stephenson]

It would be something of a pain for just 1 user but you could setup ACL's. I can't imagine why someone would want read-only access at the OS level to Oracle files because I can't think of a legitimate reason why anyone would ever access Oracle data w/o going through the database itself. If this is some sort of security auditor then a good compromise might be a cron'ed or sudo'ed task that does a find looking for all these files and displays an ls -l and checksum for each file. He would then only need access to this listing.