Operating System - OpenVMS
1827703 Members
2997 Online
109967 Solutions
New Discussion

use of synchronize in pipe command

 
SOLVED
Go to solution
Oswald Knoppers_1
Valued Contributor

use of synchronize in pipe command

Hi,

I am trying to spawn a submit command and wait for the completion of the batch job from a C program. But for some reason I am unable to synchronize on the created batch entry. The following illustrates the problem from DCL.

$ sho sym $entry
%DCL-W-UNDSYM, undefined symbol - check validity and spelling
$ pipe submit/user=system t.com ; sho sym $entry ; sync/entr='$entry'
Job T (queue ITIV29_BATCH, entry 1085) started on ITIV29_BATCH
$ENTRY = "1085"
%DCL-W-VALREQ, missing qualifier or keyword value - supply all required values
$ sho sym $entry
$ENTRY = "1085"
$ sho entr 1085
Entry Jobname Username Blocks Status
----- ------- -------- ------ ------
1085 T SYSTEM Executing
On available batch queue ITIV29_BATCH
$

Any idea as to why the sync command doesn't get the value of the $entry symbol?

Thanks,

Oswald
20 REPLIES 20
marsh_1
Honored Contributor

Re: use of synchronize in pipe command

hi,

use the /symbol qualifier to preserve the symbols through the pipe.


HTH

Karl Rohwedder
Honored Contributor
Solution

Re: use of synchronize in pipe command

/SYMBOL should be default, try a

SAP01_Roh. pip/sym sub/noprint/keep sc:a.com ; sh sym $entry ; synch /ent=&$entry
Job A (queue SAP01_BAT_QUE_7_1, entry 127) started on SAP01_BAT_QUE_7_1
$ENTRY = "127"

Job A (queue SAP01_BAT_QUE_7_1, entry 127) completed
SAP01_Roh.

instead.

regards Kalle
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Hi Mark,

According to help /symbol is default. Anyway i tried both pipe/symbol and pipe/nosymbol and the results are the same.

The weird thing is that the 'show symbol' command does show the $entry symbol while the 'sync' command apparently gets an empty string. Hence the VALREQ message.

Oswald
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Hi Karl,

Yes that's it. Thanks for your reply.

Still don't really understand as to what is happening here.

Oswald
Joseph Huber_1
Honored Contributor

Re: use of synchronize in pipe command

'$entry' will be resolved at parsing the pipe command, therefore it is empty (or would contain any old entry number).

You have too use the & substitution:

; sync/entr=&$entry

and it will work.
http://www.mpp.mpg.de/~huber
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Hi Joseph,

Yes that explains it. Thanks.

Oswald
Hakan Zanderau ( Anders
Trusted Contributor

Re: use of synchronize in pipe command

Oswald,

Take a look at chapter 12.13 in Users Manual.
http://h71000.www7.hp.com/doc/731final/6489/6489pro_033.html#syn_phases

It's about how/when DCL do symbol substitutions.

/Hakan
Don't make it worse by guessing.........
Joseph Huber_1
Honored Contributor

Re: use of synchronize in pipe command

Sorry Karls answer dived under my browsers cache.

The explanation:
The ' ' symbol substitution happens in the early DCL parsing phase (of the PIPE command): its value (or not existence) is taken at the beginning of the pipe command, before anything is executed.

The & substitution happens a stage later, when the sync command is parsed: at that time the $entry symbol has already the new value.
http://www.mpp.mpg.de/~huber
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Yep its clear to me.

Thanks all.
Hein van den Heuvel
Honored Contributor

Re: use of synchronize in pipe command



Maybe this explains:

$ pipe subm tmp ; write sys$output "old ''$entry' new ", $entry
:
old 706 new 707
$ pipe subm tmp ; write sys$output "old ''$entry' new ", $entry
:
old 707 new 708

The substitution is normally done when the command is parsed.
The & operator postpones that until the variable is used.

It is also useful for case where the symbol contains non-printables or quotes notably in the command $READ/KEY=&key_value

hth,
Hein


Hein van den Heuvel
Honored Contributor

Re: use of synchronize in pipe command

Joseph wrote>> Sorry Karls answer dived under my browsers cache.

Same here.
I compiled answer, got distracted, came back, and _thought_ I checked to topic to see whether it would still be relevant, nothing _seemed_ changed so I submitted and found the topic was closed.

I used to mostly use IE6, but had switched to CHROME which apparently had different cache settings.

Groetjes,
Hein.

RBrown_1
Trusted Contributor

Re: use of synchronize in pipe command

Interesting problem and solution.

My question is why would you want to do this? IE, why would you want to start something in batch and then hang up your terminal until the batch job competes?

What if the batch job doesn't run immediately because there are no available batch processors? Then your session will be held up even longer!

It seems to me that you might as well just run it in your interactive session. You need the output of t.com in a file?

$ @T.COM/OUTPUT=T.LOG.

John Gillings
Honored Contributor

Re: use of synchronize in pipe command

Oswald,

Perhaps it's unlikely, but there's one other issue you may want to deal with... if your batch entry completes before reaching the synchronize command, you'll get "%JBC-E-NOSUCHENT, no such entry". You can fix this with:

$ PIPE (SUBMIT/USER=SYSTEM T.COM/RETAIN=ALWAYS ; -
SYNCHRONIZE/ENTRY=&$ENTRY ; -
DELETE/ENTRY=&$ENTRY )


Note that this is also a convenient mechanism for determining the completion status of the batch job - it's $STATUS after the SYNCHRONIZE command.

I'm assuming this is part of a larger procedure... as written it's equivalent to

$ SUBMIT/USER=SYSTEM T.COM
$ SHOW SYM $ENTRY
$ SYMCHRONIZE/ENTRY=&$ENTRY

but without the symbol substitution issue. Or, maybe you're using PIPE just to put multiple commands on a single line from a call to LIB$SPAWN?

Your other option is to execute both the SUBMIT and SYNCHRONIZE directly from your C program. They're both fairly simple calls to $SNDJBC(W).
A crucible of informative mistakes
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Re. RBrown

"My question is why would you want to do this? IE, why would you want to start something in batch and then hang up your terminal until the batch job competes?"

Actually I use a small C program installed with cmk privilege. This enables non-prived userd to perform some specific task which require elevated privs. The program lib$spawns the command in question.

Oswald
John Gillings
Honored Contributor

Re: use of synchronize in pipe command

Oswald,

> This enables non-prived userd to perform
>some specific task which require elevated
>privs. The program lib$spawns the command
>in question.

Yikes! In that case I would definitely STRONGLY recommend you replace your SPAWN with direct calls to $SNDJBCW. Consider what would happen if I ran your privileged program after executing something like:

$ SUBMIT="@SYS$LOGIN:MYTROJAN #"

A crucible of informative mistakes
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Hi John,

I would start to worry about this the moment they figure out how to escape from their captivity.

All normal user accounts are captive on this system.

Oswald
RBrown_1
Trusted Contributor

Re: use of synchronize in pipe command

So why not run the privileged C program in the captive account? I don't understand why batch is involved at all. If there is no batch then synchronizing happens automatically.
John Gillings
Honored Contributor

Re: use of synchronize in pipe command

RBrown,

> I don't understand why batch is
> involved at all.

The batch job is so the target procedure executes as SYSTEM, which is also why CMKRNL is required.

> how to escape from their captivity.

Oswald, there are many ways to get a symbol defined without necessarily escaping from a captive procedure. For example, is there a menu item for MAIL? or any way your users ever get into a text editor? What about network or batch mode access?

What if someone in the future gives them access to MAIL? Would they realise they've opened up a rather large and simple to exploit security hole?

My point is the mechanism you're using creates numerous potential exploits on your system which would allow otherwise non-privileged users to execute arbitrary commands with CMKRNL privilege. If you trust that they're truly captive, why not just grant them CMKRNL up front and avoid convoluted and tricky mechanisms to pretend your users aren't privileged?

In this case, the code to make your privileged image much safer is arguably simpler, faster and more reliable than using SPAWN.

Alternatively, just grant CMKRNL as an authorized privilege, you can skip the complexity, pitfalls and wider security risks of a privileged image. Just turn on CMKRNL, SUBMIT/USER, SYNCH then turn it off.
A crucible of informative mistakes
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

Hi John,

These users don't have mail/network or batch access. But i agree with you that $sndjbcw is better. I will look in to that.

A simple change in de submit command (change is to 'submit\' will also prevent using user defined symbols.

Thanks for the discussion,

Oswald
Oswald Knoppers_1
Valued Contributor

Re: use of synchronize in pipe command

I changed the program and it now uses $SNDJBCW.

Thanks all.

Oswald