Running oninit as root on AIX
Marty saw that on AIX with Informix 11.50.FC9, oninit started as root shows up as owned by 'informix' in ps, unlike his older 10.00 instances. Art Kagel explained this is by design since early 11.x: admin and I/O VPs stay root while CPU/Java/user VPs drop to informix so UDRs can't run with root privileges (Fernando showed real vs effective UID in ps output). The real issue behind Marty's question was that local 'informix' connections to a PAM-enabled port no longer bypass PAM, forcing him to use a trusted alias; Fernando said this was a regression in 11.50.FC8/FC9, likely fixed around 11.50.FC9W3, and advised opening a PMR with IBM for confirmation.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hello,
I have installed Informix 11.50fc9 on a couple of AIX boxes, one with AIX 5.3
and one with AIX 7.1 (both 64-bit). When I run oninit as root on either box,
it shows up as being run as user informix when I do a ps -ef | grep oninit. I
want it to be shown as being run as root, like my 32-bit Informix v10.00uc5
versions do. I can't figure out why it shows the oninit processes as being
owned by informix even though I started them as the root user. Any ideas
and/or suggestions?
Thanks in advance!
-Marty
All of them? It does depend on the versions but they should change their
identity once they do the initial tasks that require root. There should be
a few exceptions like the MSC, ADM or ADT.
May we know why you run them as root, and/or you would like them to show as
root? Or are you trying to use it to distinguish between sysadmin and dbsa
as owners?.
Usually people complain if the processes are owned by root and/or
setuid.... not the opposite. I'm curious....
Regards
On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> Hello,
> I have installed Informix 11.50fc9 on a couple of AIX boxes, one with AIX
> 5.3
> and one with AIX 7.1 (both 64-bit). When I run oninit as root on either
> box,
> it shows up as being run as user informix when I do a ps -ef | grep
> oninit. I
> want it to be shown as being run as root, like my 32-bit Informix v10.00uc5
> versions do. I can't figure out why it shows the oninit processes as being
> owned by informix even though I started them as the root user. Any ideas
> and/or suggestions?
>
> Thanks in advance!
> -Marty
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--047d7b33d0f452df4604ec0670cc
Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
VPs, purpose specific VPs (like the Java VP), and User VPs (for User
Defined Routines not running in the CPU VPs) run as 'informix'. That
changed sometime early in the 11.xx. You are correct that in 10.00 and
prior, if you started the oninit as root then all of the VPs ran as root,
but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs run in
the Java VP, it was deemed unsafe to have those VPs running as root, so
they were changed to always run as 'informix' to keep UDRs and SPL routines
running 'SYSTEM' from accessing data they should not have access to.
Art
Art S. Kagel, Principal Consultant
Advanced DataTools (www.advancedatatools.com)
Blog: http://informix-myview.blogspot.com/
Disclaimer: Please keep in mind that my own opinions are my own opinions
and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
other organization with which I am associated either explicitly,
implicitly, or by inference. Neither do those opinions reflect those of
other individuals affiliated with any entity with which I am affiliated nor
those of the entities themselves.
On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com>wrote:
> All of them? It does depend on the versions but they should change their
> identity once they do the initial tasks that require root. There should be
> a few exceptions like the MSC, ADM or ADT.
>
> May we know why you run them as root, and/or you would like them to show as
> root? Or are you trying to use it to distinguish between sysadmin and dbsa
> as owners?.
>
> Usually people complain if the processes are owned by root and/or
> setuid.... not the opposite. I'm curious....
>
> Regards
> On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
>
> > Hello,
> > I have installed Informix 11.50fc9 on a couple of AIX boxes, one with AIX
> > 5.3
> > and one with AIX 7.1 (both 64-bit). When I run oninit as root on either
> > box,
> > it shows up as being run as user informix when I do a ps -ef | grep
> > oninit. I
> > want it to be shown as being run as root, like my 32-bit Informix
> v10.00uc5
> > versions do. I can't figure out why it shows the oninit processes as
> being
> > owned by informix even though I started them as the root user. Any ideas
> > and/or suggestions?
> >
> > Thanks in advance!
> > -Marty
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --047d7b33d0f452df4604ec0670cc
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--047d7b3a84c224ee8704ec06968c
I see. Thank you for the information.
The reason I ask is a little bit confusing, but I believe it has to do with
how PAM handles the local accounts root and informix when the oninit processes
are owned by informix vs root. For instance, when setting up my instances, I
normally have the instance name, say usa, set up as a PAM in the sqlhosts file:
usa onsoctcp myservername sqlakusa s=4,pam_serv=(infrmx),pamauth=(password)
and I have a trusted account for an alias, say usa_T, set up normally in the
sqlhosts file:
usa_T onsoctcp myservername sqlakusa_T
In version 10, I could do commands, such as ontape, with my INFORMIXSERVER
environment variable set to just usa and it would work fine. With version
11.50 I have to have my INFORMIXSERVER environment variable set to usa_T in
order for it to work, otherwise I get a "User informix not trusted on this
server" error (even though the informix user is listed in the servers
hosts.equiv file.
Also, when I connect via dbaccess, before I didn't have to specify my informix
userid/password when connecting to usa, whereas I do now.
I hope this makes sense! It's a little hard to explain!
- Marty
I think there is some confusion here... SYSTEM() runs with the user
identity. In fact they're one of the reasons why we need some CPU VPs
running as root (so that they can change the user identity).
Other databases behave differently (run as the instance owner - Oracle - or
as a specific user - DB2 -).
With USERMAPPING on 11.70 this may change... (more flexible)
Regards
On Mon, Nov 25, 2013 at 8:55 PM, Art Kagel <art.kagel@gmail.com> wrote:
> Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
> VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> Defined Routines not running in the CPU VPs) run as 'informix'. That
> changed sometime early in the 11.xx. You are correct that in 10.00 and
> prior, if you started the oninit as root then all of the VPs ran as root,
> but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs run in
> the Java VP, it was deemed unsafe to have those VPs running as root, so
> they were changed to always run as 'informix' to keep UDRs and SPL routines
> running 'SYSTEM' from accessing data they should not have access to.
>
> Art
>
> Art S. Kagel, Principal Consultant
>
> Advanced DataTools (www.advancedatatools.com)
> Blog: http://informix-myview.blogspot.com/
>
> Disclaimer: Please keep in mind that my own opinions are my own opinions
> and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
> other organization with which I am associated either explicitly,
> implicitly, or by inference. Neither do those opinions reflect those of
> other individuals affiliated with any entity with which I am affiliated nor
> those of the entities themselves.
>
> On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com
> >wrote:
>
> > All of them? It does depend on the versions but they should change their
> > identity once they do the initial tasks that require root. There should
> be
> > a few exceptions like the MSC, ADM or ADT.
> >
> > May we know why you run them as root, and/or you would like them to show
> as
> > root? Or are you trying to use it to distinguish between sysadmin and
> dbsa
> > as owners?.
> >
> > Usually people complain if the processes are owned by root and/or
> > setuid.... not the opposite. I'm curious....
> >
> > Regards
> > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> >
> > > Hello,
> > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one with
> AIX
> > > 5.3
> > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on either
> > > box,
> > > it shows up as being run as user informix when I do a ps -ef | grep
> > > oninit. I
> > > want it to be shown as being run as root, like my 32-bit Informix
> > v10.00uc5
> > > versions do. I can't figure out why it shows the oninit processes as
> > being
> > > owned by informix even though I started them as the root user. Any
> ideas
> > > and/or suggestions?
> > >
> > > Thanks in advance!
> > > -Marty
> > >
> > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --047d7b33d0f452df4604ec0670cc
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --047d7b3a84c224ee8704ec06968c
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...
--001a113375765afd2e04ec076212
It does... although I'm a bit confused (not by you, but by the behavior).
Traditionally local connections to PAM ports as informix would ignore the
PAM configuration. That's why I always write/say NEVER to test PAM with
user informix on the local machine.
I seem to recall that this was classified as a bug and possibly fixed in
some version... But I had the feeling it was fixed in 11.70 only.... I'd
have to check....
So, yes... What you're saying makes sense, but I don't think the "owner" of
the processes will make any difference.
In fact it would be nice that PAM connections could be used transparently
as traditional trusted connections. But i currently cannot discuss this.
Hopefully in a few months I will be able to post something on my blog (and
I'm not waiting for any new feature... just to be as clear as I can for
now).
If I can spare a few minutes I'll try to track the mentioned bug and
provide some details.
Regards
On Mon, Nov 25, 2013 at 9:18 PM, MARTY RAPP <doomdogak@yahoo.com> wrote:
> I see. Thank you for the information.
>
> The reason I ask is a little bit confusing, but I believe it has to do with
> how PAM handles the local accounts root and informix when the oninit
> processes
> are owned by informix vs root. For instance, when setting up my instances,
> I
> normally have the instance name, say usa, set up as a PAM in the sqlhosts
> file:
> usa onsoctcp myservername sqlakusa s=4,pam_serv=(infrmx),pamauth=(password)
> and I have a trusted account for an alias, say usa_T, set up normally in
> the
> sqlhosts file:
> usa_T onsoctcp myservername sqlakusa_T>
> In version 10, I could do commands, such as ontape, with my INFORMIXSERVER
> environment variable set to just usa and it would work fine. With version
> 11.50 I have to have my INFORMIXSERVER environment variable set to usa_T in
> order for it to work, otherwise I get a "User informix not trusted on this
> server" error (even though the informix user is listed in the servers
> hosts.equiv file.
>
> Also, when I connect via dbaccess, before I didn't have to specify my
> informix
> userid/password when connecting to usa, whereas I do now.
>
> I hope this makes sense! It's a little hard to explain!
>
> - Marty
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...
--047d7bd6ae8c25489304ec07812c
Ehrm... Either a confusing issue, or maybe it's just me...
From what I understand there was no intention to "fix" the initial "bug" I
mentioned. It was considered "as design" and it may make sense so that you
don't get locked out of your instance if you do a mistake on PAM
configuration (although there would be ways around it...)
But in between, apparently that "feature" vanished from 11.50.FC8,
11.50.FC9 and I think 11.50.FC9W1. This triggered the creation of another
bug which apparently has a code fix. It's probably fixed in 11.50.FC9W3.
Currently I have no time to test this, but if you're installing new
environments you may want to try the latest PID for 11.50 (11.50.FC9W3)...
For official explanation and confirmation, please open a PMR with IBM.
HTH.
Regards.
On Mon, Nov 25, 2013 at 10:01 PM, Fernando Nunes <domusonline@gmail.com>wrote:
> It does... although I'm a bit confused (not by you, but by the behavior).
> Traditionally local connections to PAM ports as informix would ignore the
> PAM configuration. That's why I always write/say NEVER to test PAM with
> user informix on the local machine.
> I seem to recall that this was classified as a bug and possibly fixed in
> some version... But I had the feeling it was fixed in 11.70 only.... I'd
> have to check....
> So, yes... What you're saying makes sense, but I don't think the "owner" of
> the processes will make any difference.
>
> In fact it would be nice that PAM connections could be used transparently
> as traditional trusted connections. But i currently cannot discuss this.
> Hopefully in a few months I will be able to post something on my blog (and
> I'm not waiting for any new feature... just to be as clear as I can for
> now).
> If I can spare a few minutes I'll try to track the mentioned bug and
> provide some details.
> Regards
>
> On Mon, Nov 25, 2013 at 9:18 PM, MARTY RAPP <doomdogak@yahoo.com> wrote:
>
> > I see. Thank you for the information.
> >
> > The reason I ask is a little bit confusing, but I believe it has to do
> with
> > how PAM handles the local accounts root and informix when the oninit
> > processes
> > are owned by informix vs root. For instance, when setting up my
> instances,
> > I
> > normally have the instance name, say usa, set up as a PAM in the sqlhosts
> > file:
> > usa onsoctcp myservername sqlakusa
> s=4,pam_serv=(infrmx),pamauth=(password)> > and I have a trusted account for an alias, say usa_T, set up normally in
> > the
> > sqlhosts file:
> > usa_T onsoctcp myservername sqlakusa_T> >
> > In version 10, I could do commands, such as ontape, with my
> INFORMIXSERVER
> > environment variable set to just usa and it would work fine. With version
> > 11.50 I have to have my INFORMIXSERVER environment variable set to usa_T
> in
> > order for it to work, otherwise I get a "User informix not trusted on
> this
> > server" error (even though the informix user is listed in the servers
> > hosts.equiv file.
> >
> > Also, when I connect via dbaccess, before I didn't have to specify my
> > informix
> > userid/password when connecting to usa, whereas I do now.
> >
> > I hope this makes sense! It's a little hard to explain!
> >
> > - Marty
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --
> Fernando Nunes
> Portugal
>
> http://informix-technology.blogspot.com
> My email works... but I don't check it frequently...
>
> --047d7bd6ae8c25489304ec07812c
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...
--047d7b6dc2248c802b04ec07e805
Yes, thank you, it helps alot!
Hi Art,
This behave you mentioned , about run as root CPU and IO VPs and as
informix others VPs , this occur only if the instance was started with root?
Here I'm working with version 11.50.FC9X6 over AIX 6.1 and we always
started the instance with informix. The setuids of the binary are set
correctly
[informix]/home/informix/cesar/tmp> ls -l $(which oninit)
-rwsr-sr-- 1 root informix 29064776 Nov 04 2011
/opt/informix/bin/oninit
When I check with ps , all process run with in informix user.
We have a v11.70 FC7 over AIX 6.1 running at our development environment.
Same behave...
When I should see the engine process run as 'root' ?
Regards
Cesar
2013/11/25 Art Kagel <art.kagel@gmail.com>
> Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
> VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> Defined Routines not running in the CPU VPs) run as 'informix'. That
> changed sometime early in the 11.xx. You are correct that in 10.00 and
> prior, if you started the oninit as root then all of the VPs ran as root,
> but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs run in
> the Java VP, it was deemed unsafe to have those VPs running as root, so
> they were changed to always run as 'informix' to keep UDRs and SPL routines
> running 'SYSTEM' from accessing data they should not have access to.
>
> Art
>
> Art S. Kagel, Principal Consultant
>
> Advanced DataTools (www.advancedatatools.com)
> Blog: http://informix-myview.blogspot.com/
>
> Disclaimer: Please keep in mind that my own opinions are my own opinions
> and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
> other organization with which I am associated either explicitly,
> implicitly, or by inference. Neither do those opinions reflect those of
> other individuals affiliated with any entity with which I am affiliated nor
> those of the entities themselves.
>
> On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com
> >wrote:
>
> > All of them? It does depend on the versions but they should change their
> > identity once they do the initial tasks that require root. There should
> be
> > a few exceptions like the MSC, ADM or ADT.
> >
> > May we know why you run them as root, and/or you would like them to show
> as
> > root? Or are you trying to use it to distinguish between sysadmin and
> dbsa
> > as owners?.
> >
> > Usually people complain if the processes are owned by root and/or
> > setuid.... not the opposite. I'm curious....
> >
> > Regards
> > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> >
> > > Hello,
> > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one with
> AIX
> > > 5.3
> > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on either
> > > box,
> > > it shows up as being run as user informix when I do a ps -ef | grep
> > > oninit. I
> > > want it to be shown as being run as root, like my 32-bit Informix
> > v10.00uc5
> > > versions do. I can't figure out why it shows the oninit processes as
> > being
> > > owned by informix even though I started them as the root user. Any
> ideas
> > > and/or suggestions?
> > >
> > > Thanks in advance!
> > > -Marty
> > >
> > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --047d7b33d0f452df4604ec0670cc
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --047d7b3a84c224ee8704ec06968c
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--f46d0438907982c03a04ec119e7d
Don't confuse login user or process owner with real or effective user id:
Individual virtual processors:
vp pid class usercpu syscpu total Thread Eff
1 6553754 cpu 2.54 0.24 2.78 25.15 11%
2 6619316 adm 0.31 0.39 0.70 0.00 0%
3 5439608 lio 0.04 0.10 0.14 0.14 100%
4 6881438 pio 0.05 0.11 0.16 0.16 100%
5 6815908 aio 0.05 0.11 0.16 0.16 100%
6 4784152 msc 0.00 0.00 0.00 0.00 0%
7 6684870 fifo 0.04 0.09 0.13 0.13 100%
8 5505170 cpu 0.59 0.16 0.75 3.42 21%
9 6029416 cpu 0.11 0.13 0.24 0.24 100%
10 6946966 cpu 0.11 0.14 0.25 0.25 100%
11 6488198 cpu 0.11 0.14 0.25 0.25 100%
12 7012570 cpu 0.11 0.14 0.25 0.25 100%
13 7078106 soc 0.47 0.53 1.00 NA NA
14 7471162 aio 0.04 0.08 0.12 0.12 100%
tot 4.57 2.36 6.93
aix71demo:root $ ps -e -o "pid,uid,ruser,user,comm" | grep oninit
4784152 0 informix root oninit
5439608 0 informix root oninit
5505170 500 informix informix oninit
6029416 500 informix informix oninit
6488198 500 informix informix oninit
6553754 500 informix informix oninit
6619316 0 informix root oninit
6684870 0 informix root oninit
6815908 0 informix root oninit
6881438 0 informix root oninit
6946966 500 informix informix oninit
7012570 500 informix informix oninit
7078106 0 informix root oninit
7471162 0 informix root oninit
aix71demo:root $
Regards.
On Tue, Nov 26, 2013 at 10:05 AM, Cesar Martins <
cesar.inacio.martins@gmail.com> wrote:
> Hi Art,
> This behave you mentioned , about run as root CPU and IO VPs and as
> informix others VPs , this occur only if the instance was started with
> root?
>
> Here I'm working with version 11.50.FC9X6 over AIX 6.1 and we always
> started the instance with informix. The setuids of the binary are set
> correctly
>
> [informix]/home/informix/cesar/tmp> ls -l $(which oninit)
> -rwsr-sr-- 1 root informix 29064776 Nov 04 2011
> /opt/informix/bin/oninit
>
> When I check with ps , all process run with in informix user.
>
> We have a v11.70 FC7 over AIX 6.1 running at our development environment.
> Same behave...
>
> When I should see the engine process run as 'root' ?
>
> Regards
> Cesar
>
> 2013/11/25 Art Kagel <art.kagel@gmail.com>
>
> > Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
> > VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> > Defined Routines not running in the CPU VPs) run as 'informix'. That
> > changed sometime early in the 11.xx. You are correct that in 10.00 and
> > prior, if you started the oninit as root then all of the VPs ran as root,
> > but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs run
> in
> > the Java VP, it was deemed unsafe to have those VPs running as root, so
> > they were changed to always run as 'informix' to keep UDRs and SPL
> routines
> > running 'SYSTEM' from accessing data they should not have access to.
> >
> > Art
> >
> > Art S. Kagel, Principal Consultant
> >
> > Advanced DataTools (www.advancedatatools.com)
> > Blog: http://informix-myview.blogspot.com/
> >
> > Disclaimer: Please keep in mind that my own opinions are my own opinions
> > and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
> > other organization with which I am associated either explicitly,
> > implicitly, or by inference. Neither do those opinions reflect those of
> > other individuals affiliated with any entity with which I am affiliated
> nor
> > those of the entities themselves.
> >
> > On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com
> > >wrote:
> >
> > > All of them? It does depend on the versions but they should change
> their
> > > identity once they do the initial tasks that require root. There should
> > be
> > > a few exceptions like the MSC, ADM or ADT.
> > >
> > > May we know why you run them as root, and/or you would like them to
> show
> > as
> > > root? Or are you trying to use it to distinguish between sysadmin and
> > dbsa
> > > as owners?.
> > >
> > > Usually people complain if the processes are owned by root and/or
> > > setuid.... not the opposite. I'm curious....
> > >
> > > Regards
> > > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> > >
> > > > Hello,
> > > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one with
> > AIX
> > > > 5.3
> > > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on
> either
> > > > box,
> > > > it shows up as being run as user informix when I do a ps -ef | grep
> > > > oninit. I
> > > > want it to be shown as being run as root, like my 32-bit Informix
> > > v10.00uc5
> > > > versions do. I can't figure out why it shows the oninit processes as
> > > being
> > > > owned by informix even though I started them as the root user. Any
> > ideas
> > > > and/or suggestions?
> > > >
> > > > Thanks in advance!
> > > > -Marty
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > >
> > > >
> > >
> > > --047d7b33d0f452df4604ec0670cc
> > >
> > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --047d7b3a84c224ee8704ec06968c
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --f46d0438907982c03a04ec119e7d
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...
--089e0160bc6e4bf5ad04ec1238f0
That's what I see in Linux. Perhaps AIX runs differently.
Art
Art S. Kagel, Principal Consultant
Advanced DataTools (www.advancedatatools.com)
Blog: http://informix-myview.blogspot.com/
Disclaimer: Please keep in mind that my own opinions are my own opinions
and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
other organization with which I am associated either explicitly,
implicitly, or by inference. Neither do those opinions reflect those of
other individuals affiliated with any entity with which I am affiliated nor
those of the entities themselves.
On Tue, Nov 26, 2013 at 5:05 AM, Cesar Martins <
cesar.inacio.martins@gmail.com> wrote:
> Hi Art,
> This behave you mentioned , about run as root CPU and IO VPs and as
> informix others VPs , this occur only if the instance was started with
> root?
>
> Here I'm working with version 11.50.FC9X6 over AIX 6.1 and we always
> started the instance with informix. The setuids of the binary are set
> correctly
>
> [informix]/home/informix/cesar/tmp> ls -l $(which oninit)
> -rwsr-sr-- 1 root informix 29064776 Nov 04 2011
> /opt/informix/bin/oninit
>
> When I check with ps , all process run with in informix user.
>
> We have a v11.70 FC7 over AIX 6.1 running at our development environment.
> Same behave...
>
> When I should see the engine process run as 'root' ?
>
> Regards
> Cesar
>
> 2013/11/25 Art Kagel <art.kagel@gmail.com>
>
> > Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
> > VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> > Defined Routines not running in the CPU VPs) run as 'informix'. That
> > changed sometime early in the 11.xx. You are correct that in 10.00 and
> > prior, if you started the oninit as root then all of the VPs ran as root,
> > but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs run
> in
> > the Java VP, it was deemed unsafe to have those VPs running as root, so
> > they were changed to always run as 'informix' to keep UDRs and SPL
> routines
> > running 'SYSTEM' from accessing data they should not have access to.
> >
> > Art
> >
> > Art S. Kagel, Principal Consultant
> >
> > Advanced DataTools (www.advancedatatools.com)
> > Blog: http://informix-myview.blogspot.com/
> >
> > Disclaimer: Please keep in mind that my own opinions are my own opinions
> > and do not reflect on my employer, Advanced DataTools, the IIUG, nor any
> > other organization with which I am associated either explicitly,
> > implicitly, or by inference. Neither do those opinions reflect those of
> > other individuals affiliated with any entity with which I am affiliated
> nor
> > those of the entities themselves.
> >
> > On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com
> > >wrote:
> >
> > > All of them? It does depend on the versions but they should change
> their
> > > identity once they do the initial tasks that require root. There should
> > be
> > > a few exceptions like the MSC, ADM or ADT.
> > >
> > > May we know why you run them as root, and/or you would like them to
> show
> > as
> > > root? Or are you trying to use it to distinguish between sysadmin and
> > dbsa
> > > as owners?.
> > >
> > > Usually people complain if the processes are owned by root and/or
> > > setuid.... not the opposite. I'm curious....
> > >
> > > Regards
> > > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> > >
> > > > Hello,
> > > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one with
> > AIX
> > > > 5.3
> > > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on
> either
> > > > box,
> > > > it shows up as being run as user informix when I do a ps -ef | grep
> > > > oninit. I
> > > > want it to be shown as being run as root, like my 32-bit Informix
> > > v10.00uc5
> > > > versions do. I can't figure out why it shows the oninit processes as
> > > being
> > > > owned by informix even though I started them as the root user. Any
> > ideas
> > > > and/or suggestions?
> > > >
> > > > Thanks in advance!
> > > > -Marty
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > >
> > > >
> > >
> > > --047d7b33d0f452df4604ec0670cc
> > >
> > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --047d7b3a84c224ee8704ec06968c
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --f46d0438907982c03a04ec119e7d
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
--001a1133a55cd7424704ec1291e8
Hmmmm ok , are you right..
The ps you passed show the my oinit as root process.
when I checked with ps I use : "ps -fe" and ps -eo "ruser,comm" only...
and this "mask" the correct owner... which is the "user" option...
thanks!
2013/11/26 Fernando Nunes <domusonline@gmail.com>
> Don't confuse login user or process owner with real or effective user id:
>
> Individual virtual processors:
> vp pid class usercpu syscpu total Thread Eff
> 1 6553754 cpu 2.54 0.24 2.78 25.15 11%
> 2 6619316 adm 0.31 0.39 0.70 0.00 0%
> 3 5439608 lio 0.04 0.10 0.14 0.14 100%
> 4 6881438 pio 0.05 0.11 0.16 0.16 100%
> 5 6815908 aio 0.05 0.11 0.16 0.16 100%
> 6 4784152 msc 0.00 0.00 0.00 0.00 0%
> 7 6684870 fifo 0.04 0.09 0.13 0.13 100%
> 8 5505170 cpu 0.59 0.16 0.75 3.42 21%
> 9 6029416 cpu 0.11 0.13 0.24 0.24 100%
> 10 6946966 cpu 0.11 0.14 0.25 0.25 100%
> 11 6488198 cpu 0.11 0.14 0.25 0.25 100%
> 12 7012570 cpu 0.11 0.14 0.25 0.25 100%
> 13 7078106 soc 0.47 0.53 1.00 NA NA
> 14 7471162 aio 0.04 0.08 0.12 0.12 100%
>
> tot 4.57 2.36 6.93
>
> aix71demo:root $ ps -e -o "pid,uid,ruser,user,comm" | grep oninit
> 4784152 0 informix root oninit
> 5439608 0 informix root oninit
> 5505170 500 informix informix oninit
> 6029416 500 informix informix oninit
> 6488198 500 informix informix oninit
> 6553754 500 informix informix oninit
> 6619316 0 informix root oninit
> 6684870 0 informix root oninit
> 6815908 0 informix root oninit
> 6881438 0 informix root oninit
> 6946966 500 informix informix oninit
> 7012570 500 informix informix oninit
> 7078106 0 informix root oninit
> 7471162 0 informix root oninit
> aix71demo:root $
>
> Regards.
>
> On Tue, Nov 26, 2013 at 10:05 AM, Cesar Martins <
> cesar.inacio.martins@gmail.com> wrote:
>
> > Hi Art,
> > This behave you mentioned , about run as root CPU and IO VPs and as
> > informix others VPs , this occur only if the instance was started with
> > root?
> >
> > Here I'm working with version 11.50.FC9X6 over AIX 6.1 and we always
> > started the instance with informix. The setuids of the binary are set
> > correctly
> >
> > [informix]/home/informix/cesar/tmp> ls -l $(which oninit)
> > -rwsr-sr-- 1 root informix 29064776 Nov 04 2011
> > /opt/informix/bin/oninit
> >
> > When I check with ps , all process run with in informix user.
> >
> > We have a v11.70 FC7 over AIX 6.1 running at our development environment.
> > Same behave...
> >
> > When I should see the engine process run as 'root' ?
> >
> > Regards
> > Cesar
> >
> > 2013/11/25 Art Kagel <art.kagel@gmail.com>
> >
> > > Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the CPU
> > > VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> > > Defined Routines not running in the CPU VPs) run as 'informix'. That
> > > changed sometime early in the 11.xx. You are correct that in 10.00 and
> > > prior, if you started the oninit as root then all of the VPs ran as
> root,
> > > but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs
> run
> > in
> > > the Java VP, it was deemed unsafe to have those VPs running as root, so
> > > they were changed to always run as 'informix' to keep UDRs and SPL
> > routines
> > > running 'SYSTEM' from accessing data they should not have access to.
> > >
> > > Art
> > >
> > > Art S. Kagel, Principal Consultant
> > >
> > > Advanced DataTools (www.advancedatatools.com)
> > > Blog: http://informix-myview.blogspot.com/
> > >
> > > Disclaimer: Please keep in mind that my own opinions are my own
> opinions
> > > and do not reflect on my employer, Advanced DataTools, the IIUG, nor
> any
> > > other organization with which I am associated either explicitly,
> > > implicitly, or by inference. Neither do those opinions reflect those of
> > > other individuals affiliated with any entity with which I am affiliated
> > nor
> > > those of the entities themselves.
> > >
> > > On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <domusonline@gmail.com
> > > >wrote:
> > >
> > > > All of them? It does depend on the versions but they should change
> > their
> > > > identity once they do the initial tasks that require root. There
> should
> > > be
> > > > a few exceptions like the MSC, ADM or ADT.
> > > >
> > > > May we know why you run them as root, and/or you would like them to
> > show
> > > as
> > > > root? Or are you trying to use it to distinguish between sysadmin and
> > > dbsa
> > > > as owners?.
> > > >
> > > > Usually people complain if the processes are owned by root and/or
> > > > setuid.... not the opposite. I'm curious....
> > > >
> > > > Regards
> > > > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> > > >
> > > > > Hello,
> > > > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one
> with
> > > AIX
> > > > > 5.3
> > > > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on
> > either
> > > > > box,
> > > > > it shows up as being run as user informix when I do a ps -ef | grep
> > > > > oninit. I
> > > > > want it to be shown as being run as root, like my 32-bit Informix
> > > > v10.00uc5
> > > > > versions do. I can't figure out why it shows the oninit processes
> as
> > > > being
> > > > > owned by informix even though I started them as the root user. Any
> > > ideas
> > > > > and/or suggestions?
> > > > >
> > > > > Thanks in advance!
> > > > > -Marty
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > > >
> > > > >
> > > >
> > > > --047d7b33d0f452df4604ec0670cc
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > >
> > > >
> > >
> > > --047d7b3a84c224ee8704ec06968c
> > >
> > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --f46d0438907982c03a04ec119e7d
> >
> >
> >
> >
>
>
*******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --
> Fernando Nunes
> Portugal
>
> http://informix-technology.blogspot.com
> My email works... but I don't check it frequently...
>
> --089e0160bc6e4bf5ad04ec1238f0
>
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>
@@
The processes were launched as "informix" but because they belong to root
and are setuid they get root. Some of them change to Informix after initial
tasks depending on their "role". A bit confusing and may be different
between versions. But it's an attempt to leave as root just what needs to
be root.
Regards
On Tue, Nov 26, 2013 at 12:37 PM, Cesar Martins <
cesar.inacio.martins@gmail.com> wrote:
> Hmmmm ok , are you right..
>
> The ps you passed show the my oinit as root process.
>
> when I checked with ps I use : "ps -fe" and ps -eo "ruser,comm" only...
> and this "mask" the correct owner... which is the "user" option...
> thanks!
>
> 2013/11/26 Fernando Nunes <domusonline@gmail.com>
>
> > Don't confuse login user or process owner with real or effective user id:
> >
> > Individual virtual processors:
> > vp pid class usercpu syscpu total Thread Eff
> > 1 6553754 cpu 2.54 0.24 2.78 25.15 11%
> > 2 6619316 adm 0.31 0.39 0.70 0.00 0%
> > 3 5439608 lio 0.04 0.10 0.14 0.14 100%
> > 4 6881438 pio 0.05 0.11 0.16 0.16 100%
> > 5 6815908 aio 0.05 0.11 0.16 0.16 100%
> > 6 4784152 msc 0.00 0.00 0.00 0.00 0%
> > 7 6684870 fifo 0.04 0.09 0.13 0.13 100%
> > 8 5505170 cpu 0.59 0.16 0.75 3.42 21%
> > 9 6029416 cpu 0.11 0.13 0.24 0.24 100%
> > 10 6946966 cpu 0.11 0.14 0.25 0.25 100%
> > 11 6488198 cpu 0.11 0.14 0.25 0.25 100%
> > 12 7012570 cpu 0.11 0.14 0.25 0.25 100%
> > 13 7078106 soc 0.47 0.53 1.00 NA NA
> > 14 7471162 aio 0.04 0.08 0.12 0.12 100%
> >
> > tot 4.57 2.36 6.93
> >
> > aix71demo:root $ ps -e -o "pid,uid,ruser,user,comm" | grep oninit
> > 4784152 0 informix root oninit
> > 5439608 0 informix root oninit
> > 5505170 500 informix informix oninit
> > 6029416 500 informix informix oninit
> > 6488198 500 informix informix oninit
> > 6553754 500 informix informix oninit
> > 6619316 0 informix root oninit
> > 6684870 0 informix root oninit
> > 6815908 0 informix root oninit
> > 6881438 0 informix root oninit
> > 6946966 500 informix informix oninit
> > 7012570 500 informix informix oninit
> > 7078106 0 informix root oninit
> > 7471162 0 informix root oninit
> > aix71demo:root $
> >
> > Regards.
> >
> > On Tue, Nov 26, 2013 at 10:05 AM, Cesar Martins <
> > cesar.inacio.martins@gmail.com> wrote:
> >
> > > Hi Art,
> > > This behave you mentioned , about run as root CPU and IO VPs and as
> > > informix others VPs , this occur only if the instance was started with
> > > root?
> > >
> > > Here I'm working with version 11.50.FC9X6 over AIX 6.1 and we always
> > > started the instance with informix. The setuids of the binary are set
> > > correctly
> > >
> > > [informix]/home/informix/cesar/tmp> ls -l $(which oninit)
> > > -rwsr-sr-- 1 root informix 29064776 Nov 04 2011
> > > /opt/informix/bin/oninit
> > >
> > > When I check with ps , all process run with in informix user.
> > >
> > > We have a v11.70 FC7 over AIX 6.1 running at our development
> environment.
> > > Same behave...
> > >
> > > When I should see the engine process run as 'root' ?
> > >
> > > Regards
> > > Cesar
> > >
> > > 2013/11/25 Art Kagel <art.kagel@gmail.com>
> > >
> > > > Administrative VPs and IO VPs (AIO, LIO, & PIO) run as root and the
> CPU
> > > > VPs, purpose specific VPs (like the Java VP), and User VPs (for User
> > > > Defined Routines not running in the CPU VPs) run as 'informix'. That
> > > > changed sometime early in the 11.xx. You are correct that in 10.00
> and
> > > > prior, if you started the oninit as root then all of the VPs ran as
> > root,
> > > > but now that C UDRs can run in the CPU VPs or User VPs and Java UDRs
> > run
> > > in
> > > > the Java VP, it was deemed unsafe to have those VPs running as root,
> so
> > > > they were changed to always run as 'informix' to keep UDRs and SPL
> > > routines
> > > > running 'SYSTEM' from accessing data they should not have access to.
> > > >
> > > > Art
> > > >
> > > > Art S. Kagel, Principal Consultant
> > > >
> > > > Advanced DataTools (www.advancedatatools.com)
> > > > Blog: http://informix-myview.blogspot.com/
> > > >
> > > > Disclaimer: Please keep in mind that my own opinions are my own
> > opinions
> > > > and do not reflect on my employer, Advanced DataTools, the IIUG, nor
> > any
> > > > other organization with which I am associated either explicitly,
> > > > implicitly, or by inference. Neither do those opinions reflect those
> of
> > > > other individuals affiliated with any entity with which I am
> affiliated
> > > nor
> > > > those of the entities themselves.
> > > >
> > > > On Mon, Nov 25, 2013 at 3:45 PM, Fernando Nunes <
> domusonline@gmail.com
> > > > >wrote:
> > > >
> > > > > All of them? It does depend on the versions but they should change
> > > their
> > > > > identity once they do the initial tasks that require root. There
> > should
> > > > be
> > > > > a few exceptions like the MSC, ADM or ADT.
> > > > >
> > > > > May we know why you run them as root, and/or you would like them to
> > > show
> > > > as
> > > > > root? Or are you trying to use it to distinguish between sysadmin
> and
> > > > dbsa
> > > > > as owners?.
> > > > >
> > > > > Usually people complain if the processes are owned by root and/or
> > > > > setuid.... not the opposite. I'm curious....
> > > > >
> > > > > Regards
> > > > > On Nov 25, 2013 7:36 PM, "MARTY RAPP" <doomdogak@yahoo.com> wrote:
> > > > >
> > > > > > Hello,
> > > > > > I have installed Informix 11.50fc9 on a couple of AIX boxes, one
> > with
> > > > AIX
> > > > > > 5.3
> > > > > > and one with AIX 7.1 (both 64-bit). When I run oninit as root on
> > > either
> > > > > > box,
> > > > > > it shows up as being run as user informix when I do a ps -ef |
> grep
> > > > > > oninit. I
> > > > > > want it to be shown as being run as root, like my 32-bit Informix
> > > > > v10.00uc5
> > > > > > versions do. I can't figure out why it shows the oninit processes
> > as
> > > > > being
> > > > > > owned by informix even though I started them as the root user.
> Any
> > > > ideas
> > > > > > and/or suggestions?
> > > > > >
> > > > > > Thanks in advance!
> > > > > > -Marty
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > > > Forum Note: Use "Reply" to post a response in the discussion
> forum.
> > > > > >
> > > > > >
> > > > >
> > > > > --047d7b33d0f452df4604ec0670cc
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
*******************************************************************************
> > > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > > >
> > > > >
> > > >
> > > > --047d7b3a84c224ee8704ec06968c
> > > >
> > > >
> > > >
> > >