DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references;
        b=vA8e0VR9vgnvJX5KPH6hM4nLlVvIzKyjqkxpO/hT2BGII/dYHaerK3wo88SHHsjX7jKehCNeZHRm7eogzBNWNY2i964Sf7DIARbWVCqwBLyRxJWnUE9z2aNDcCJQXz3bSY2ZKF4pQDbcKl6Cso1EO06HJrPkaWgun60usLVmmgk=
Message-ID: <d4beff360802221106t7d6318a8l4d98b618ef857fec@mail.gmail.com>
Date: Fri, 22 Feb 2008 13:06:12 -0600
From: "Greg Norris" <spikey.mcmarbles@gmail.com>
To: ORACLE-L <oracle-l@freelists.org>
Subject: Re: CRS/RAC external-procedure handling
In-Reply-To: <d4beff360802071844w6351710v3e9d9e5ef5694ef7@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_772_10000165.1203707172162"
References: <d4beff360802071844w6351710v3e9d9e5ef5694ef7@mail.gmail.com>
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-to: spikey.mcmarbles@gmail.com
------=_Part_772_10000165.1203707172162
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

For anyone who's curious, I was indeed able to convince CRS to run our
extproc listener as a restricted (non-DBA) user.  The steps were actually
fairly simple, although I took a number of detours along the way.

   1. Create the listener in the usual manner via *netca*, and ensure
   that it's shutdown.
   2. Convince your friendly neighborhood SysAdmin to run the following
   commands, which set the CRS ownership/permissions for the listener resource,
   as root.  The specific resource name can be determined using the *
   crs_stat* utility... in my case it was *
   ora.dkds0602.LISTENER_EXTPROC_DKDS0602.lsnr*.

$ crs_setperm RESOURCE -o USER
$ crs_setperm RESOURCE -g GROUP
$ crs_setperm RESOURCE -u user:oracle:r-x

Once this is done, it's a straightforward matter of ensuring that the
relevant file and directory permissions are set correctly (listener.ora,
log/trace directories, external procedure libraries, etc.), after which the
listener can be started normally via the *srvctl* command.

My thanx to Dan Norris for pointing me in the right direction!


On Thu, Feb 7, 2008 at 8:44 PM, Greg Norris <spikey.mcmarbles@gmail.com>
wrote:

> We're planning to migrate an existing application which requires an
> external procedure into a recently-created 10.2.0.3 RAC environment on
> Solaris 10.  At this point we've created a separate IPC-only listener on
> each node to handle extproc calls, and have validated that it allows us to
> invoke the procedure successfully.
>
> The next thing we'd like to do is get the extproc listener running as a
> limited OS user, rather than under the oracle account.  Can anyone tell me
> if this is possible when the listener is managed through CRS?  We don't mind
> writing a few scripts, if necessary, but would prefer not to duplicate the
> CRS monitoring/restart infrastructure.
>
> My apologies if this is rather basic... I'll happily accept a pointer to
> the FM to R. :)  We're still a bit new to the whole CRS/RAC environment, and
> it's entirely possible that I simply don't know where to look.
>
> Thanx!
>

-- 
"I'm too sexy for my code." - Awk Sed Fred.

------=_Part_772_10000165.1203707172162
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

For anyone who&#39;s curious, I was indeed able to convince CRS to run our extproc listener as a restricted (non-DBA) user.&nbsp; The steps were actually fairly simple, although I took a number of detours along the way. <br><ol>
<li>Create the listener in the usual manner via <i>netca</i>, and ensure that it&#39;s shutdown.<br></li><li>Convince your friendly neighborhood SysAdmin to run the following commands, which set the CRS ownership/permissions for the listener resource, as root.&nbsp; The specific resource name can be determined using the <i>crs_stat</i> utility... in my case it was <i>ora.dkds0602.LISTENER_EXTPROC_DKDS0602.lsnr</i>.<br>
</li></ol><div style="margin-left: 40px;"><span style="font-family: courier new,monospace;">$ crs_setperm RESOURCE -o USER</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">$ crs_setperm </span><span style="font-family: courier new,monospace;">RESOURCE </span><span style="font-family: courier new,monospace;">-g GROUP</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">$ crs_setperm </span><span style="font-family: courier new,monospace;">RESOURCE</span><span style="font-family: courier new,monospace;"> -u user:oracle:r-x</span><br></div>
<br>Once this is done, it&#39;s a straightforward matter of ensuring that the relevant file and directory permissions are set correctly (listener.ora, log/trace directories, external procedure libraries, etc.), after which the listener can be started normally via the <i>srvctl</i> command.<br>
<br>My thanx to Dan Norris for pointing me in the right direction!<br><br><br><div class="gmail_quote">On Thu, Feb 7, 2008 at 8:44 PM, Greg Norris &lt;<a href="mailto:spikey.mcmarbles@gmail.com">spikey.mcmarbles@gmail.com</a>&gt; wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">We&#39;re planning to migrate an existing application which requires an external procedure into a recently-created <a href="http://10.2.0.3" target="_blank">10.2.0.3</a> RAC environment on Solaris 10.&nbsp; At this point we&#39;ve created a separate IPC-only listener on each node to handle extproc calls, and have validated that it allows us to invoke the procedure successfully.<br>


<br>The next thing we&#39;d like to do is get the extproc listener running as a limited OS user, rather than under the oracle account.&nbsp; Can anyone tell me if this is possible when the listener is managed through CRS?&nbsp; We don&#39;t mind writing a few scripts, if necessary, but would prefer not to duplicate the CRS monitoring/restart infrastructure.<br>

<br>My apologies if this is rather basic... I&#39;ll happily accept a pointer to the FM to R. :)&nbsp; We&#39;re still a bit new to the whole CRS/RAC environment, and it&#39;s entirely possible that I simply don&#39;t know where to look.<br>

<br>Thanx!<br></blockquote></div><br>-- <br>&quot;I&#39;m too sexy for my code.&quot; - Awk Sed Fred.<br>

------=_Part_772_10000165.1203707172162--
--
http://www.freelists.org/webpage/oracle-l