Why Do My Database Permissions Change?


Contents

About this document
    Related documentation
Device files in the /dev directory
Enhancements in AIX version 4.3.2
Recommended fixes


About this document

This document discusses the device files in the /dev directory for each logical volume (LV), and the circumstances under which the permissions for these device files would change (especially Raw LV's). This document assumes that the permissions, owner, group, etc. were changed manually to suit the needs of a database application that accesses these logical volumes.

This document applies to AIX versions 4.x.


Related documentation

For more information related to this document see:

The synclvodm command:
http://www.rs6000.ibm.com/doc_link/en_US/a_doc_lib/cmds/aixcmds5/synclvodm.htm

Storage Management Guide (in PDF format):
http://www.redbooks.ibm.com

The product documentation library is also available:
http://www.rs6000.ibm.com/resource/aix_resource/Pubs/index.html


Device files in the /dev directory

There are two device files in the dev directory for each logical volume.

For example, enter ls -l /dev/lv00 /dev/rlv00.

brw-rw----   1 root     system    42,  3 May 12 07:29 lv00
crw-rw----   1 root     system    42,  3 May 12 07:29 rlv00

The b at the beginning of the line indicates a block device. The c indicates a character device.

The default permissions for these files are 660 and are owned by root. The group is system.

Some database applications need these device files to be owned by the application or by another user. If the permissions are changed, the device files may look something like the following:

brw-rw-rw-   1 oracle   database  42,  3 May 12 05:30 lv00
crw-rw-rw-   1 oracle   database  42,  3 May 12 05:30 rlv00

Since there is no way to retain these permissions if you need to remove and recreate these device files, they are brought back to system defaults when certain commands are executed.

NOTE: Some changes made in AIX 4.3.2 store these permissions, as explained in the section "Enhancements in AIX version 4.3.2."

Some possible reasons for the recreation of the device files are:

  1. A volume group is in an exported state. There is no information about the volume group/logical volume(s) in the Object Data Manager (ODM), rather the information is on the disk(s) themselves. When the volume group is imported using the synclvodm command, the device files are recreated. Because there is no way to maintain the permissions of the device files, they are recreated with the system defaults.

    Solution: There is no resolution if the volume group was in an exported state and was just imported unless you are at AIX 4.3.2. The only resolution is to change the permissions for the files after the Volume group is imported.

  2. If the synclvodm command is run when the Volume Group is imported and varied on, the device files in the dev directory are removed and recreated with system defaults.

    Solution: At AIX 4.15 and above, synclvodm (assuming the correct patches for bos.rte.lvm are installed) has an undocumented -P flag that retains the permissions of the device files in the /dev directory. Following are the APARs that add the enhancements to the synclvodm command that would retain the permissions of the device files (the -P flag):


Enhancements in AIX version 4.3.2

In AIX version 4.3.2, there have been enhancements to the mklv and the chlv commands which store these permissions. Even if the volume group is in an exported state, and you import the volume group back in using the -R flag with importvg, all the permissions are retained.

NOTE: These changes can be made only if the volume group that contains these logical volumes is in big VG format, as these permissions are stored in the Volume Group Descriptor Area (VGDA). Check the man pages for mkvg and chvg for the new flags that enable you to create big Volume Groups.

Following are the new flags added to mklv and chlv:

-P Modes
Specifies permissions (file modes) for the logical volume special file.
-U Userid
Specifies user ID for the logical volume special file.
-G Groupid
Specifies group ID for the logical volume special file.
If any or all of these flags are used while creating the logical volume (mklv) or after the logical volume is created (chlv), the permissions will be retained.

NOTE: If the volume group is exported and needs to be imported, the -R flag must be used with importvg. If the synclvodm command is run, you must still use the -P flag to retain the permissions.

If the volume group is imported without the -R flag, you can still export the volume group. Import again using the -R flag, and the permissions will be retained. However, if synclvodm is run without the -P flag, rerunning this command with the -P flag will not change the permissions back to what you want them to be, and they will remain at system defaults.


Recommended fixes

IY06350 4.3.3.10 synclvodm:
Creates a bad ODM stanza for an LVwith invalid LVCB.

IY06812 4.3.3.10 synclvodm:
Does not populate the ODM in case of a -L option.
IY06350 4.3.3.3 synclvodm :

Creates a bad ODM stanza for an LV with invalid LVCB.



[ Doc Ref: 95486132612738     Publish Date: Oct. 02, 2000     4FAX Ref: 8493 ]