|
Problem IC65030
|
Status: Closed |
DB2IMIGR SETS INCORRECT PERMISSIONS FOR KERBEROS CATALOG DIRECTORIES IN SQLDBDIR (SQLKRB) |
| product: |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 |
| Problem description: |
When we have a database catalogued as using Kerberos
authentication, the migration from v8 to v9.x will render the
catalog directory unusable
To reproduce:
1.
$ db2 catalog tcpip node thost remote thost server 50000
DB20000I The CATALOG TCPIP NODE command completed successfully.
DB21056W Directory changes may not be effective until the
directory cache is
refreshed.
$ db2 catalog database tkerb as tkerb at node thost
authentication kerberos target principal db2@thost.db2lab.com
DB20000I The CATALOG DATABASE command completed successfully.
DB21056W Directory changes may not be effective until the
directory cache is
refreshed.
$
/home/db2inst9/sqllib/sqldbdir
$ ls -al
total 16
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 .
drwxrwxr-t 18 db2inst9 db2iadm9 1024 Dec 3 13:29 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 sqldbbak
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:29 sqldbdir
-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:29 sqldbins
drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb
$ ls -al sqlkrb
total 6
drwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 13:29 .
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 32 Dec 3 13:29 TKERB
2.
After running db2imigr the permissions show incorrect. In
certain cases this directory could be corrupt
/home/db2inst9/sqllib/sqldbdir
$ ls -al
total 22
drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:36 .
drwxrwxr-t 19 db2inst9 db2iadm9 1024 Dec 3 13:36 ..
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 sqldbbak
-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 13:36 sqldbdir
-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 13:36 sqldbins
-rw-rw-r-- 1 db2inst9 db2iadm9 2148 Dec 3 13:36
sqldddir.bak
drw-rw-r-- 2 db2inst9 db2iadm9 512 Dec 3 13:29 sqlkrb
3. Running db2 list database directory will throw error
SQL10004C and db2diag.log will show access permission errors on
sqlkrb
$ db2 list database directory
System Database Directory
Number of entries in the directory = 1
SQL10004C An I/O error occurred while accessing the database
directory.
SQLSTATE=58031
FUNCTION: DB2 Common, OSSe, ossErrorIOAnalysis, probe:100
CALLED : OS, -, open
OSERR : EACCES (13) "Permission denied"
DATA #1 : String, 141 bytes
A total of 2 analysis will be performed :
- User info
- Path access permission
Target file = /home/db2inst9/sqllib/sqldbdir/sqlkrb/TKERB
DATA #2 : String, 184 bytes
Real user ID of current process = 221
Effective user ID of current process = 221
Real group ID of current process = 111
Effective group ID of current process = 111
DATA #3 : String, 328 bytes
Information of each subdirectory leading up to the first
inaccessible one is shown in the format below :
<UID>:<GID>:<permissions> (subdirectories)
0:0:755 (home)
221:111:755 (db2inst9)
221:111:1775 (sqllib)
221:111:775 (sqldbdir)
221:111:664 (sqlkrb) |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* ALL *
****************************************************************
* PROBLEM DESCRIPTION: *
* DB2IMIGR SETS INCORRECT PERMISSIONS FOR KERBEROS *
* CATALOGDIRECTORIES IN SQLDBDIR (SQLKRB)When we have a *
* database catalogued as using Kerberosauthentication, the *
* migration from v8 to v9.x will renderthecatalog directory *
* unusableTo reproduce:1.$ db2 catalog tcpip node thost remote *
* thost server 50000DB20000I The CATALOG TCPIP NODE command *
* completedsuccessfully.DB21056W Directory changes may not be *
* effective until thedirectory cache isrefreshed.$ db2 catalog *
* database tkerb as tkerb at node thostauthentication kerberos *
* target principaldb2@thost.db2lab.comDB20000I The CATALOG *
* DATABASE command completedsuccessfully.DB21056W Directory *
* changes may not be effective until thedirectory cache *
* isrefreshed.$/home/db2inst9/sqllib/sqldbdir$ ls -altotal *
* 16drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 13:29 *
* .drwxrwxr-t 18 db2inst9 db2iadm9 1024 Dec 3 13:29 *
* ..-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 *
* 13:29sqldbbak-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 *
* 13:29sqldbdir-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 *
* 13:29sqldbinsdrwxrwxr-x 2 db2inst9 db2iadm9 512 Dec 3 *
* 13:29 sqlkrb$ ls -al sqlkrbtotal 6drwxrwxr-x 2 db2inst9 *
* db2iadm9 512 Dec 3 13:29 .drwxrwxr-x 3 db2inst9 *
* db2iadm9 512 Dec 3 13:29 ..-rw-rw-r-- 1 db2inst9 *
* db2iadm9 32 Dec 3 13:29 TKERB2.After running db2imigr *
* the permissions show incorrect. Incertain cases this *
* directory could be corrupt/home/db2inst9/sqllib/sqldbdir$ ls *
* -altotal 22drwxrwxr-x 3 db2inst9 db2iadm9 512 Dec 3 *
* 13:36 .drwxrwxr-t 19 db2inst9 db2iadm9 1024 Dec 3 13:36 *
* ..-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 *
* 13:36sqldbbak-rw-rw-r-- 1 db2inst9 db2iadm9 1512 Dec 3 *
* 13:36sqldbdir-rw-rw-r-- 1 db2inst9 db2iadm9 540 Dec 3 *
* 13:36sqldbins-rw-rw-r-- 1 db2inst9 db2iadm9 2148 Dec 3 *
* 13:36sqldddir.bakdrw-rw-r-- 2 db2inst9 db2iadm9 512 *
* Dec 3 13:29 sqlkrb3. Running db2 list database directory *
* will throw errorSQL10004C and db2diag.log will show access *
* permissionerrors onsqlkrb$ db2 list database directorySystem *
* Database DirectoryNumber of entries in the directory = *
* 1SQL10004C An I/O error occurred while accessing *
* thedatabasedirectory.SQLSTATE=58031FUNCTION: DB2 Common, *
* OSSe, ossErrorIOAnalysis, probe:100CALLED : OS, -, *
* openOSERR : EACCES (13) "Permission denied"DATA #1 : *
* String, 141 bytesA total of 2 analysis will be performed :- *
* User info- Path access permissionTarget file = *
* /home/db2inst9/sqllib/sqldbdir/sqlkrb/TKERBDATA #2 : String, *
* 184 bytesReal user ID of current process = *
* 221Effective user ID of current process = 221Real group ID *
* of current process = 111Effective group ID of current *
* process = 111DATA #3 : String, 328 bytesInformation of each *
* subdirectory leading up to the firstinaccessible one is *
* shown in the format below :<UID>:<GID>:<permissions> *
* (subdirectories)0:0:755 (home)221:111:755 *
* (db2inst9)221:111:1775 (sqllib)221:111:775 *
* (sqldbdir)221:111:664 (sqlkrb) *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 9.7 Fix Pack 2 *
**************************************************************** |
| Local Fix: |
Uncatalog databases that use Kerberos authentication previous to
running db2imigr and catalog them again afterwards.
If already have run db2imgr and the directory sqlkrb shows wrong
permissions run chmod ug=rwx,o=rx. |
| available fix packs: |
DB2 Version 9.7 Fix Pack 2 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
|
| Solution |
Problem was first fixed in Version 9.7 Fix Pack 2 |
| Workaround |
not known / see Local fix |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 08.12.2009
14.04.2010
14.04.2010 |
| Problem solved at the following versions (IBM BugInfos) |
9.7.FP2
|
| Problem solved according to the fixlist(s) of the following version(s) |
| 9.7.0.2
|
 |
