privgrp - what would cause it to be reset

[S.Rider]

We set the MLOCK privgrp for group-dba on a bunch of servers the beginning of Feb.
Created the file "/etc/privgrp" containing the line "dba MLOCK"
Then ran the command "setprivgrp -f /etc/privgrp".
Then a "getprivgrp dba" showed "dba: MLOCK".

They used it then for a bit, now 5 months later they want it again, but it's gone. All the servers have been patched since then.

Is privgrp supposed to stay forever ?
Or what would reset it ?

[A. Clay Stephenson · Accepted solution]

When the patches were applied the privgroups went undefined because the command in /sbin/init.d/set_prvgrp is actually looking for the file "/etc/privgroup" and not finding does nothing. Rename your file, execute the command, "/sbin/init.d/set_prvgrp start" and you are good and will also be set when the box reboots.

[A. Clay Stephenson]

When the patches were applied the privgroups went undefined because the command in /sbin/init.d/set_prvgrp is actually looking for the file "/etc/privgroup" and not finding it does nothing. Rename your file, execute the command, "/sbin/init.d/set_prvgrp start" and you are good and will also be set when the box reboots.

[Sundar_7]

Jay,

Yes, /etc/privgrp should have been left alone. It will be interesting to know the patch that changed/removed the file

Can you execute the following command and paste the output ?

# swlist -l file | grep "/etc/privgrp"

Sundar.

[A. Clay Stephenson]

No Sundar, it has nothing to do with patching; the problem is that they initially named the configuration file "/etc/privgrp" and ran the setprivgrp command specifying that file but the rc script in /sbin/init.d is specifically looking for "/etc/privgroup". Although UNIX hates vowels, they are nonetheless significant.

While you are at it, it would also be wise to make sure that the correct symbolic link is in place:

cd /sbin/rc1.d
ls -l *prvgrp*

You should see a soft link to the "real" script in /sbin/init.d.