|
Problem IC65028
|
Status: Closed |
DB2IMIGR SETS INCORRECT PERMISSIONS FOR KERBEROS CATALOG DIRECTORIES IN SQLDBDIR (SQLKRB) |
| product: |
DB2 FOR LUW / DB2FORLUW / 910 - DB2 |
| Problem description: |
When we have a database catalogued as using Kerberos
authentication, the migration from v8 to v9.x will render the
catalog directory unusable
To reproduce:
1.
$ db2 catalog tcpip node thost remote thost server 50000
DB20000I The CATALOG TCPIP NODE command completed successfully.
DB21056W Directory changes may not be effective until the
directory cache is
refreshed.
$ db2 catalog database tkerb as tkerb at node thost
authentication kerberos target principal db2@thost.db2lab.com
DB20000I The CATALOG DATABASE command completed successfully.
DB21056W Directory changes may not be effective until the
directory cache is
refreshed.
$
/home/db2inst9/sqllib/sqldbdir
$ ls -al
total 16
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 .
drwxrwxr-t 18 db2inst9 db2iadm9 1024 Dec 3 13:29 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 sqldbbak
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 sqldbdir
-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:29 sqldbins
drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb
$ ls -al sqlkrb
total 6
drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 .
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 32 Dec 3 13:29 TKERB
2.
After running db2imigr the permissions show incorrect. In
certain cases this directory could be corrupt
/home/db2inst9/sqllib/sqldbdir
$ ls -al
total 22
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:36 .
drwxrwxr-t 19 db2inst9 db2iadm9 1024 Dec 3 13:36 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 sqldbbak
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 sqldbdir
-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:36 sqldbins
-rw-rw-r-- 1 db2inst9 db2iadm9 2148 Dec 3 13:36
sqldddir.bak
drw-rw-r-- 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb
3. Running db2 list database directory will throw error
SQL10004C and db2diag.log will show access permission errors on
sqlkrb
$ db2 list database directory
System Database Directory
Number of entries in the directory = 1
SQL10004C An I/O error occurred while accessing the database
directory.
SQLSTATE=58031
FUNCTION: DB2 Common, OSSe, ossErrorIOAnalysis, probe:100
CALLED : OS, -, open
OSERR : EACCES (13) "Permission denied"
DATA #1 : String, 141 bytes
A total of 2 analysis will be performed :
- User info
- Path access permission
Target file = /home/db2inst9/sqllib/sqldbdir/sqlkrb/TKERB
DATA #2 : String, 184 bytes
Real user ID of current process = 221
Effective user ID of current process = 221
Real group ID of current process = 111
Effective group ID of current process = 111
DATA #3 : String, 328 bytes
Information of each subdirectory leading up to the first
inaccessible one is shown in the format below :
<UID>:<GID>:<permissions> (subdirectories)
0:0:755 (home)
221:111:755 (db2inst9)
221:111:1775 (sqllib)
221:111:775 (sqldbdir)
221:111:664 (sqlkrb) |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* ALL *
****************************************************************
* PROBLEM DESCRIPTION: *
* DB2IMIGR SETS INCORRECT PERMISSIONS FOR KERBEROS *
* CATALOGDIRECTORIES IN SQLDBDIR (SQLKRB) *
* *
* When we have a database catalogued as using Kerberos *
* *
* authentication, the migration from v8 to v9.x will render *
* the *
* catalog directory unusable *
* *
* *
* *
* To reproduce: *
* *
* 1. *
* *
* $ db2 catalog tcpip node thost remote thost server 50000 *
* *
* DB20000I The CATALOG TCPIP NODE command completed *
* successfully. *
* DB21056W Directory changes may not be effective until the *
* *
* directory cache is *
* *
* refreshed. *
* *
* $ db2 catalog database tkerb as tkerb at node thost *
* *
* authentication kerberos target principal *
* db2@thost.db2lab.com *
* DB20000I The CATALOG DATABASE command completed *
* successfully. *
* DB21056W Directory changes may not be effective until the *
* *
* directory cache is *
* *
* refreshed. *
* *
* $ *
* *
* *
* *
* /home/db2inst9/sqllib/sqldbdir *
* *
* *
* *
* $ ls -al *
* *
* total 16 *
* *
* drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 . *
* drwxrwxr-t 18 db2inst9 db2iadm9 1024 Dec 3 13:29 .. *
* *
* -rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 *
* sqldbbak *
* -rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 *
* sqldbdir *
* -rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:29 sqldbins *
* *
* drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb *
* *
* *
* *
* $ ls -al sqlkrb *
* *
* total 6 *
* *
* drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 . *
* drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 .. *
* *
* -rw-rw-r-- 1 db2inst9 db2iadm9 32 Dec 3 13:29 TKERB *
* *
* *
* *
* 2. *
* *
* After running db2imigr the permissions show incorrect. In *
* *
* certain cases this directory could be corrupt *
* *
* *
* *
* /home/db2inst9/sqllib/sqldbdir *
* *
* $ ls -al *
* *
* total 22 *
* *
* drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:36 . *
* drwxrwxr-t 19 db2inst9 db2iadm9 1024 Dec 3 13:36 .. *
* *
* -rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 *
* sqldbbak *
* -rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 *
* sqldbdir *
* -rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:36 sqldbins *
* *
* -rw-rw-r-- 1 db2inst9 db2iadm9 2148 Dec 3 13:36 *
* *
* sqldddir.bak *
* *
* drw-rw-r-- 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb *
* *
* *
* *
* 3. Running db2 list database directory will throw error *
* *
* SQL10004C and db2diag.log will show access permission *
* errors on *
* sqlkrb *
* *
* *
* *
* $ db2 list database directory *
* *
* System Database Directory *
* *
* Number of entries in the directory = 1 *
* *
* SQL10004C An I/O error occurred while accessing the *
* database *
* directory. *
* *
* SQLSTATE=58031 *
* *
* *
* *
* FUNCTION: DB2 Common, OSSe, ossErrorIOAnalysis, probe:100 *
* *
* CALLED : OS, -, open *
* *
* OSERR : EACCES (13) "Permission denied" *
* *
* DATA #1 : String, 141 bytes *
* *
* A total of 2 analysis will be performed : *
* *
* - User info *
* *
* - Path access permission *
* *
* *
* *
* Target file = /home/db2inst9/sqllib/sqldbdir/sqlkrb/TKERB *
* *
* DATA #2 : String, 184 bytes *
* *
* Real user ID of current process = 221 *
* *
* Effective user ID of current process = 221 *
* *
* Real group ID of current process = 111 *
* *
* Effective group ID of current process = 111 *
* *
* DATA #3 : String, 328 bytes *
* *
* Information of each subdirectory leading up to the first *
* *
* inaccessible one is shown in the format below : *
* *
* <UID>:<GID>:<permissions> (subdirectories) *
* *
* *
* *
* 0:0:755 (home) *
* *
* 221:111:755 (db2inst9) *
* *
* 221:111:1775 (sqllib) *
* *
* 221:111:775 (sqldbdir) *
* *
* 221:111:664 (sqlkrb) *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 9.1 Fix Pack 9 *
**************************************************************** |
| Local Fix: |
Uncatalog databases that use Kerberos authentication previous to
running db2imigr and catalog them again afterwards.
If already have run db2imgr and the directory sqlkrb shows wrong
permissions run chmod ug=rwx,o=rx. |
| available fix packs: |
DB2 Version 9.1 Fix Pack 9 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12 for Linux, UNIX and Windows
|
| Solution |
Problem was first fixed in Version 9.1 Fix Pack 9 |
| Workaround |
not known / see Local fix |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 08.12.2009
14.04.2010
14.04.2010 |
| Problem solved at the following versions (IBM BugInfos) |
9.1.FP9
|
| Problem solved according to the fixlist(s) of the following version(s) |
| 9.1.0.9
|
 |
