Permission (s bit) of the brtools executable

[benoit-schmid]

Hello,

Note 113747 specifies:

---

brarchive, brbackup, and brconnect have permission 4775:

-rwsrwxr-x ora<sid> sapsys ...

These can be started by the ora<sid> or the <sid>adm OS user.

brrestore, brrecover, brspace, brtools, and sapdba have permission 755:

-rwxr-xr-x <sid>adm sapsys ...

These should only be started by the ora<sid> OS user.

---

ECC6 saproot.sh does:

---

1. If file brbackup exists, system must be running Oracle. Execute block.

if \[ -f /usr/sap/$/SYS/exe/run/brbackup ]; then FILELST1="brbackup brarchive brconnect brtools" for i in $FILELST1 do if \[ -f /usr/sap/$/SYS/exe/run/$i ]; then

echo "Preparing /usr/sap/$/SYS/exe/run/$i ..." chown ora$ /usr/sap/$/SYS/exe/run/$i

if [ $? -ne 0 ];then

echo " Error occurred by chown file /usr/sap/$/SYS/exe/run/$i!" echo " Please check what's the matter" fi chmod 4775 /usr/sap/$/SYS/exe/run/$i

if [ $? -ne 0 ];then

echo " Error occurred by chmod file /usr/sap/$/SYS/exe/run/$i!"

echo " Please check what's the matter"

fi

fi

done

---

Therefore it sets the s bit for brtools.

I would like to know if the note or the script is correct?

What are the risk of not running brrestore, brrecover, brspace, brtools as orasid?

Thanks in advance for your answer.

[Former Member]

brtools usually does not have the setuid bit and is owned by sidadm. brtools is only a interactive user interface that calls brconnect and friends.

If the orasid does not own the other files, then you will have a problem doing things like restore files. The database is owned by orasid, look at the file permissions in sapdata for example.

Cheers Michael

[benoit-schmid]

Hello,

> If the orasid does not own the other files, then you will have a problem doing things like restore files. The database is owned by orasid, look at the file permissions in sapdata for example.

But the note 113747 clearly says that a restore should not be performed as sidadm:

"These should only be started by the ora<sid> OS user."

I am wondering why it should not be performed as sid adm.

Thanks in advance for your answer.