disk:[000000]security.sys file deleted :o(

[Edwin R. van der Kaaij]

Good Day!

We have a privileged DbA that has deleted the security.sys file off the top level of one of our user disks.

This is the definition:
Volume security profile: SECURITY.SYS
The volume security profile contains the volume's owner UIC, the volume protection mask, and its access control list.

We have run anal/disk/repair, but it did't re-create the file.

Can we expect problems? Can we recreate this file? What to do?

Greetings from Ed.

[Wim Van den Wyngaert]

How did he do that ? On my system it's locked.

Wim

[Edwin R. van der Kaaij]

Hello Wim,

That's a good question. I have no idea. He walked in this morning and reported that he deleted it. Maybe it wasn't locked here?

Fact is that it is not there now.

Greetings, Ed.

[Wim Van den Wyngaert]

Mmm mounted it wrongly. No lock but file protection forbids me. I'll search for it.

Wim

[Karl Rohwedder]

Just made a test:
- the file is not opened
- but trying t delete always results in a 'insufficient priv' error, regardless of setting SET PROC/PRIV=ALL or SET SECURITY

What VMS version?
Have you treid to set some security related chars. of the volume, perhaps the file is recreated?

regards Kalle

[Wim Van den Wyngaert]

Found it.

set file/rem disk:[000000]security.sys

After that, gone.

Dismount disk. Mount disk. It's re-created.

So, remount.

Wim

[Edwin R. van der Kaaij]

OpenVMS V7.3-2

Thanks for your suggestions!

I'll dismount/mount at a convenient time and report the final results/status here.

Ed.

[Wim Van den Wyngaert]

Only make sure the dba didn't take all blocks from the disk and that there is free space to create the file.

Wim

[Edwin R. van der Kaaij]

Wim,

I found a system where it's possible to test this issue. I have tried many things, but there is NO way that i can delete the security.sys file. I even set myself as the owner, changed the protection, turned on all privileges etc, but cannot delete it.

I have the log of the delete (from DbA) in front of me. He did a del *.*;* at [000000] level. All files were denied access, but the security.sys file was gone.

Any more suggestions so i can test the remount?

[Hein van den Heuvel]

Wim>> set file/rem disk:[000000]security.sys
Wim>> After that, gone.

Then ANAL/DISK would also recover it, and DFU and probably readily find it.

And if it was the first time, then you can just recreate a directory entry for file 10,10 using the attached program.

Wim>> Dismount disk. Mount disk. It's re-created.

Likely with a new file id. Again, try DFU?

Hint: Using a DECram, or LDdriver, disk it is realy easy to experiment with this without inconveniencing users.

Groetjes,
Hein.

/*
** enter.C create directory entry for a file ID.
**
** Have fun, Hein van den Heuvel, HP 6/4/2002
*/
#include ssdef
#include rms
#include stdio
#include string
#include stdlib

main(int argc, char *argv[])
{
int i, status, sys$parse(), sys$enter();
char *p, expanded_name[256], resultand_name[256];
struct FAB fab;
struct NAM nam;

if (argc < 4) {
printf ("Usage $%s [x] [x] \n", argv[0]);
return 268435456;
} else {

fab = cc$rms_fab;
fab.fab$l_fop = FAB$M_NAM;
fab.fab$l_dna = ".DAT";
fab.fab$b_dns = strlen(fab.fab$l_dna);
fab.fab$l_fna = argv[3];
fab.fab$b_fns = strlen (argv[3]);
fab.fab$l_nam = &nam;

nam = cc$rms_nam;
nam.nam$b_nop = NAM$M_NOCONCEAL;
nam.nam$l_rsa = resultand_name;
nam.nam$b_rss = 255;
nam.nam$l_esa = expanded_name;
nam.nam$b_ess = 255;


status = sys$parse( &fab );
if (status & 1) {
i = atoi (argv[1]);
nam.nam$w_fid_num = (short) i;
nam.nam$b_fid_nmx = (unsigned char) (i >> 16);
nam.nam$w_fid_seq = (short) atoi ( argv[2] );
status = sys$enter ( &fab );
}
return status;
}
}

[Wim Van den Wyngaert]

Edwin,

I did a mount of the disk without /system.
Retried it and worked again. On VMS 6.2 1h3. Indeed anal/dis finds it back and puts it in [syslost] as Hein said. Check there too because maybe the dba used that command too.

I remounted it and found again the file recreated. If I do a diff between the 2 files they are not identical.

I've read that starting from VMS 6 the file is created at mount time. If create fails, mount fails.

Wim

[Edwin R. van der Kaaij]

Hein, Wim,

Thank you both for your input!

I'm not getting any further though.
I do not have DFU available and cannot start using it just like that.
I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.
I have tried all kinds of (dis)mounts on the test system, but there is NO way that I get the file deleted. I created an a.a, removed it, found it back in [syslost] etc. but no luck with the security.sys file :o(

More later...

[Hein van den Heuvel]

>> I do not have DFU available and cannot start using it just like that.

Sure you can :-).
How can you efficiently manage an OpenVMS system without this Freeware?

>> I'll try to run the program at a later stage, can't get it compiled $cxx gives 2 errors.

I never tried cxx, just used 'cc'.

Or download an executable from:
http://h71000.www7.hp.com/freeware/freeware60/rms_tools/enter.exe

[Edwin R. van der Kaaij]

don't have cc either :o) i tried that first haha. just downloaded the executable.

i'll try everything later, daily problems have stacked up, so i need to attend to them first.

thanks for all the suggestions.

[Wim Van den Wyngaert]

Did you use the statement
$ set file/remove disk:[000000]security.sys
to delete the file ? This should always work imo (Hein ?).

Wim

[Volker Halle]

Wim,


$ set file/remove disk:[000000]security.sys


A SET FILE/REMOVE command does NOT delete the file, it just removes its directory entry. The file still exists and is a so-called 'lost file', as there are no directory-entries pointing to it.

ANAL/DISK/REPAIR will put the file into [SYSLOST], from where you can rename it back to its original place.

Volker.

[Wim Van den Wyngaert]

I know that Volker.

But it's the only way to delete the open file for simulating the problem.

Wim