Question on ownership of oninit

Posted in 2007

Kern Doe — Mon, 21 May 2007 14:33:32 — source: IIUG Forums & Mailing Lists

I seem to agree with Art's 10 year-old comment (see below) -- basically, if Informix instance is started by root, oninit processes will be owned by root; if started as Informix then they will be owned by Informix. However, at this environment, oninit processes are always owned by root whether Informix instance is started by root or Informix -- Does anyone know the reason? Thanks for any comment. Kern -- On 1st July 1998 kagel@bloomberg.net (Art S. Kagel) wrote:- The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line. It really does not matter much in general except that on different platforms there may be a requirement for the owner to be root in order for processor affinity, core dumping, NOAGE, etc to function properly. Since oninit is an SUID program it's real and effective userid may differ if not started as root which will cause problems core dumping and changing process status such as aging and affinity on certain systems.

↪ replying to Kern Doe

ART KAGEL, BLOOMBERG/ 731 — Mon, 21 May 2007 16:29:54 — source: IIUG Forums & Mailing Lists

IDS versions prior to 9.20 (including 7.31) are all owned by root and are SUID programs so no matter who starts them they run as root. Later releases are owned by user informix so the behavior is different. Art S. Kagel ----- Original Message ----- From: Kern Doe <ids@iiug.org> At: 5/21 10:33:55 I seem to agree with Art's 10 year-old comment (see below) -- basically, if Informix instance is started by root, oninit processes will be owned by root; if started as Informix then they will be owned by Informix. However, at this environment, oninit processes are always owned by root whether Informix instance is started by root or Informix -- Does anyone know the reason? Thanks for any comment. Kern -- On 1st July 1998 kagel@bloomberg.net (Art S. Kagel) wrote:- The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line. It really does not matter much in general except that on different platforms there may be a requirement for the owner to be root in order for processor affinity, core dumping, NOAGE, etc to function properly. Since oninit is an SUID program it's real and effective userid may differ if not started as root which will cause problems core dumping and changing process status such as aging and affinity on certain systems. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to ART KAGEL, BLOOMBERG/ 731

Kern Doe — Mon, 21 May 2007 16:40:19 — source: IIUG Forums & Mailing Lists

Huhm... but in 1998 you said this "The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line.". My records for a system that I used to work with (IDS 7.31 OS=Dynix/ptx) where Informix oninit processes were owned by Informix: ps -eF | sort +4 -rn | more informix 13777 1 245 649736 533092 13:18:10 ? 25:52 oninit -v informix 13924 13803 9 649732 5920 13:20:25 ? 1:11 oninit -v informix 13803 13777 227 649728 527292 3 13:19:39 ? 29:27 oninit -v informix 13804 13777 254 649728 525548 0 13:19:39 ? 25:59 oninit -v informix 13808 13777 0 649728 4700 13:19:43 ? 0:03 oninit -v informix 13926 13803 4 649708 5404 13:20:26 ? 1:17 oninit -v informix 13927 13803 9 649708 4352 13:20:26 ? 0:50 oninit -v informix 13802 13777 0 649696 1400 13:19:38 ? 0:03 oninit -v informix 13805 13777 1 649696 2068 13:19:40 ? 0:03 oninit -v informix 13806 13777 0 649696 1480 13:19:41 ? 0:00 oninit -v informix 13807 13777 11 649696 398384 13:19:42 ? 3:40 oninit -v informix 13809 13777 10 649696 391908 13:19:44 ? 3:34 oninit v ----- Original Message ---- From: "ART KAGEL, BLOOMBERG/ 731 LEXIN" <kagel@bloomberg.net> To: ids@iiug.org Sent: Monday, May 21, 2007 12:29:54 PM Subject: Re: Question on ownership of oninit [9201] IDS versions prior to 9.20 (including 7.31) are all owned by root and are SUID programs so no matter who starts them they run as root. Later releases are owned by user informix so the behavior is different. Art S. Kagel ----- Original Message ----- From: Kern Doe <ids@iiug.org> At: 5/21 10:33:55 I seem to agree with Art's 10 year-old comment (see below) -- basically, if Informix instance is started by root, oninit processes will be owned by root; if started as Informix then they will be owned by Informix. However, at this environment, oninit processes are always owned by root whether Informix instance is started by root or Informix -- Does anyone know the reason? Thanks for any comment. Kern -- On 1st July 1998 kagel@bloomberg.net (Art S. Kagel) wrote:- The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line. It really does not matter much in general except that on different platforms there may be a requirement for the owner to be root in order for processor affinity, core dumping, NOAGE, etc to function properly. Since oninit is an SUID program it's real and effective userid may differ if not started as root which will cause problems core dumping and changing process status such as aging and affinity on certain systems. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Kern Doe

ART KAGEL, BLOOMBERG/ 731 — Mon, 21 May 2007 17:15:47 — source: IIUG Forums & Mailing Lists

From the 7.31UD8XH $INFORMIXDIR/etc/IDSfiles file: bin/oninit root informix 6754 BRAND VRSN SUG These are the 'official' permissions settings that the installation script and bind executable apply during installation. My posting in 1998 was discussion changing the ownership from the default to improve security if you always start the engine as informix anyway. It was never neccessary for root to own/run the oninit processes except to make starting the engine from within the rc scripts a bit easier. Indeed it was shortly thereafter that Informix changed the default ownership for oninit from root to informix for 9.20 (IB that was the release) and began to discourage us from using root at all. Art S. Kagel ----- Original Message ----- From: Kern Doe <ids@iiug.org> At: 5/21 12:40:37 Huhm... but in 1998 you said this "The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line.". My records for a system that I used to work with (IDS 7.31 OS=Dynix/ptx) where Informix oninit processes were owned by Informix: ps -eF | sort +4 -rn | more informix 13777 1 245 649736 533092 13:18:10 ? 25:52 oninit -v informix 13924 13803 9 649732 5920 13:20:25 ? 1:11 oninit -v informix 13803 13777 227 649728 527292 3 13:19:39 ? 29:27 oninit -v informix 13804 13777 254 649728 525548 0 13:19:39 ? 25:59 oninit -v informix 13808 13777 0 649728 4700 13:19:43 ? 0:03 oninit -v informix 13926 13803 4 649708 5404 13:20:26 ? 1:17 oninit -v informix 13927 13803 9 649708 4352 13:20:26 ? 0:50 oninit -v informix 13802 13777 0 649696 1400 13:19:38 ? 0:03 oninit -v informix 13805 13777 1 649696 2068 13:19:40 ? 0:03 oninit -v informix 13806 13777 0 649696 1480 13:19:41 ? 0:00 oninit -v informix 13807 13777 11 649696 398384 13:19:42 ? 3:40 oninit -v informix 13809 13777 10 649696 391908 13:19:44 ? 3:34 oninit -v ----- Original Message ---- From: "ART KAGEL, BLOOMBERG/ 731 LEXIN" <kagel@bloomberg.net> To: ids@iiug.org Sent: Monday, May 21, 2007 12:29:54 PM Subject: Re: Question on ownership of oninit [9201] IDS versions prior to 9.20 (including 7.31) are all owned by root and are SUID programs so no matter who starts them they run as root. Later releases are owned by user informix so the behavior is different. Art S. Kagel ----- Original Message ----- From: Kern Doe <ids@iiug.org> At: 5/21 10:33:55 I seem to agree with Art's 10 year-old comment (see below) -- basically, if Informix instance is started by root, oninit processes will be owned by root; if started as Informix then they will be owned by Informix. However, at this environment, oninit processes are always owned by root whether Informix instance is started by root or Informix -- Does anyone know the reason? Thanks for any comment. Kern -- On 1st July 1998 kagel@bloomberg.net (Art S. Kagel) wrote:- The ownership of the running oninit processes should be root if the engine is started from the system startup and informix if started by user informix from the command line. It really does not matter much in general except that on different platforms there may be a requirement for the owner to be root in order for processor affinity, core dumping, NOAGE, etc to function properly. Since oninit is an SUID program it's real and effective userid may differ if not started as root which will cause problems core dumping and changing process status such as aging and affinity on certain systems. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.