Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I stumbled upon something very surprising which I cannot understand on a Red Hat EL 5.6 box : the user hri (which is in the group dba) is able to kill processes owned by user oracle (which is also in group dba).

Is anybody able to explain what could allow an unprivileged user to kill another user's processes? Even if Oracle process was written to handle signals, I though processes could not trap SIGKILL(9).

Below is a session log which shows that.

OracleServer:/home/hri> export ORACLE_SID=HRIXXXDW

OracleServer:/home/hri> sqlplus / as sysdba

SQL*Plus: Release 10.2.0.5.0 - Production on Thu Dec 12 17:30:56 2013

Copyright (c) 1982, 2010, Oracle.  All Rights Reserved.

Connected to an idle instance.

SQL> startup
ORA-09925: Unable to create audit trail file
Linux-x86_64 Error: 13: Permission denied
Additional information: 9925
SQL> Disconnected

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      28295  0.0  0.0  61164   676 pts/9    S+   17:31   0:00                  \_ grep HRIXXX
oracle   28263  0.0  0.0 759668 17384 ?        Ss   17:31   0:00 ora_pmon_HRIXXXDW
oracle   28265  0.0  0.0 758488 16576 ?        Ss   17:31   0:00 ora_psp0_HRIXXXDW
oracle   28267  0.1  0.0 758488 23948 ?        Ss   17:31   0:00 ora_mman_HRIXXXDW
oracle   28269  0.0  0.0 760968 19308 ?        Ss   17:31   0:00 ora_dbw0_HRIXXXDW
oracle   28271  0.0  0.0 760960 19284 ?        Ss   17:31   0:00 ora_dbw1_HRIXXXDW
oracle   28273  0.0  0.0 758488 16656 ?        Ss   17:31   0:00 ora_lgwr_HRIXXXDW
oracle   28275  0.0  0.0 758492 19092 ?        Ss   17:31   0:00 ora_ckpt_HRIXXXDW
oracle   28277  0.0  0.0 758488 16596 ?        Ss   17:31   0:00 ora_smon_HRIXXXDW
oracle   28279  0.0  0.0 758488 16588 ?        Ss   17:31   0:00 ora_reco_HRIXXXDW
oracle   28281  0.0  0.0 758488 16772 ?        Ss   17:31   0:00 ora_mmon_HRIXXXDW
oracle   28283  0.0  0.0 758488 16612 ?        Ss   17:31   0:00 ora_mmnl_HRIXXXDW

OracleServer:/home/hri> /bin/kill -9 28263

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      28309  0.0  0.0  61164   676 pts/9    S+   17:31   0:00                  \_ grep HRIXXX
oracle   28265  0.0  0.0 758488 16584 ?        Ss   17:31   0:00 ora_psp0_HRIXXXDW
oracle   28267  0.0  0.0 758488 23948 ?        Ss   17:31   0:00 ora_mman_HRIXXXDW
oracle   28269  0.0  0.0 760968 19316 ?        Ss   17:31   0:00 ora_dbw0_HRIXXXDW
oracle   28271  0.0  0.0 760960 19284 ?        Ss   17:31   0:00 ora_dbw1_HRIXXXDW
oracle   28273  0.0  0.0 758488 16656 ?        Ss   17:31   0:00 ora_lgwr_HRIXXXDW
oracle   28275  0.0  0.0 758492 19096 ?        Ss   17:31   0:00 ora_ckpt_HRIXXXDW
oracle   28277  0.0  0.0 758488 16596 ?        Ss   17:31   0:00 ora_smon_HRIXXXDW
oracle   28279  0.0  0.0 758488 16588 ?        Ss   17:31   0:00 ora_reco_HRIXXXDW
oracle   28281  0.0  0.0 758488 16772 ?        Ss   17:31   0:00 ora_mmon_HRIXXXDW
oracle   28283  0.0  0.0 758488 16620 ?        Ss   17:31   0:00 ora_mmnl_HRIXXXDW

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      28435  0.0  0.0  61164   676 pts/9    S+   17:32   0:00                  \_ grep HRIXXX

Below are a kill -15 then a kill -9, with strace :

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      26278  0.0  0.0  61164   676 pts/9    S+   17:16   0:00                  \_ grep HRIXXX
oracle   12412  0.0  0.0 759660 19724 ?        Ss   16:10   0:00 ora_pmon_HRIXXXDW
oracle   12414  0.0  0.0 758484 16608 ?        Ss   16:10   0:00 ora_psp0_HRIXXXDW
oracle   12416  0.0  0.0 758484 23992 ?        Ss   16:10   0:00 ora_mman_HRIXXXDW
oracle   12418  0.0  0.0 760980 19352 ?        Ss   16:10   0:00 ora_dbw0_HRIXXXDW
oracle   12420  0.0  0.0 760968 19316 ?        Ss   16:10   0:00 ora_dbw1_HRIXXXDW
oracle   12422  0.0  0.0 758484 16700 ?        Ss   16:10   0:00 ora_lgwr_HRIXXXDW
oracle   12424  0.0  0.0 758504 19152 ?        Ss   16:10   0:00 ora_ckpt_HRIXXXDW
oracle   12426  0.0  0.0 758484 16708 ?        Ss   16:10   0:00 ora_smon_HRIXXXDW
oracle   12428  0.0  0.0 758484 16616 ?        Ss   16:10   0:00 ora_reco_HRIXXXDW
oracle   12430  0.0  0.0 758484 16812 ?        Ss   16:10   0:00 ora_mmon_HRIXXXDW
oracle   12432  0.0  0.0 758484 16644 ?        Ss   16:10   0:00 ora_mmnl_HRIXXXDW

OracleServer:/home/hri> strace kill 12414
execve("/bin/kill", ["kill", "12414"], [/* 32 vars */]) = 0
brk(0)                                  = 0xe36e000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7756000
uname({sys="Linux", node="
OracleServer", ...})  = 0
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=101954, ...}) = 0
mmap(NULL, 101954, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b25c7757000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY)      = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\332\301\302;\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1722304, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7770000
mmap(0x3bc2c00000, 3502424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3bc2c00000
mprotect(0x3bc2d4e000, 2097152, PROT_NONE) = 0
mmap(0x3bc2f4e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14e000) = 0x3bc2f4e000
mmap(0x3bc2f53000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3bc2f53000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7771000
arch_prctl(ARCH_SET_FS, 0x2b25c7771260) = 0
mprotect(0x3bc2f4e000, 16384, PROT_READ) = 0
mprotect(0x3bc2a1b000, 4096, PROT_READ) = 0
munmap(0x2b25c7757000, 101954)          = 0
brk(0)                                  = 0xe36e000
brk(0xe38f000)                          = 0xe38f000
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=56450560, ...}) = 0
mmap(NULL, 56450560, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b25c7772000
close(3)                                = 0
kill(12414, SIGTERM)                    = 0
exit_group(0)                           = ?

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      26328  0.0  0.0  61164   676 pts/9    S+   17:16   0:00                  \_ grep HRIXXX
oracle   12412  0.0  0.0 759660 19724 ?        Ss   16:10   0:00 ora_pmon_HRIXXXDW
oracle   12414  0.0  0.0 758484 16608 ?        Ss   16:10   0:00 ora_psp0_HRIXXXDW
oracle   12416  0.0  0.0 758484 23992 ?        Ss   16:10   0:00 ora_mman_HRIXXXDW
oracle   12418  0.0  0.0 760980 19352 ?        Ss   16:10   0:00 ora_dbw0_HRIXXXDW
oracle   12420  0.0  0.0 760968 19316 ?        Ss   16:10   0:00 ora_dbw1_HRIXXXDW
oracle   12422  0.0  0.0 758484 16700 ?        Ss   16:10   0:00 ora_lgwr_HRIXXXDW
oracle   12424  0.0  0.0 758504 19152 ?        Ss   16:10   0:00 ora_ckpt_HRIXXXDW
oracle   12426  0.0  0.0 758484 16708 ?        Ss   16:10   0:00 ora_smon_HRIXXXDW
oracle   12428  0.0  0.0 758484 16616 ?        Ss   16:10   0:00 ora_reco_HRIXXXDW
oracle   12430  0.0  0.0 758484 16812 ?        Ss   16:10   0:00 ora_mmon_HRIXXXDW
oracle   12432  0.0  0.0 758484 16644 ?        Ss   16:10   0:00 ora_mmnl_HRIXXXDW

OracleServer:/home/hri> strace kill -9 12414
execve("/bin/kill", ["kill", "-9", "12414"], [/* 32 vars */]) = 0
brk(0)                                  = 0x1b155000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2e4000
uname({sys="Linux", node="
OracleServer", ...})  = 0
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=101954, ...}) = 0
mmap(NULL, 101954, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2ac77c2e5000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY)      = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\332\301\302;\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1722304, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2fe000
mmap(0x3bc2c00000, 3502424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3bc2c00000
mprotect(0x3bc2d4e000, 2097152, PROT_NONE) = 0
mmap(0x3bc2f4e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14e000) = 0x3bc2f4e000
mmap(0x3bc2f53000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3bc2f53000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2ff000
arch_prctl(ARCH_SET_FS, 0x2ac77c2ff260) = 0
mprotect(0x3bc2f4e000, 16384, PROT_READ) = 0
mprotect(0x3bc2a1b000, 4096, PROT_READ) = 0
munmap(0x2ac77c2e5000, 101954)          = 0
brk(0)                                  = 0x1b155000
brk(0x1b176000)                         = 0x1b176000
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=56450560, ...}) = 0
mmap(NULL, 56450560, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2ac77c300000
close(3)                                = 0
kill(12414, SIGKILL)                    = 0
exit_group(0)                           = ?

OracleServer:/home/hri> ps auxf | grep HRIXXX
hri      26380  0.0  0.0  61164   676 pts/9    S+   17:17   0:00                  \_ grep HRIXXX

Now some information on the users and the OS:

OracleServer:/home/hri> uname -a
Linux OracleServer 2.6.18-186.el5 #1 SMP Wed Jan 27 18:11:22 EST 2010 x86_64 x86_64 x86_64 GNU/Linux

OracleServer:/home/hri> cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.6 (Tikanga)

OracleServer:/home/hri> id
uid=20314(hri) gid=20175(hri) groups=20001(dba),20175(hri)

OracleServer:/home/hri> id oracle
uid=20001(oracle) gid=20001(dba) groups=20001(dba),20000(xxxxx),20768(xxxxx),20329(xxxxx),20767(xxxxx),20930(xxxxx),20271(xxxxx),20316(xxxxx)

OracleServer:/home/hri> alias kill
bash: alias: kill: not found

OracleServer:/home/hri> type kill
kill is a shell builtin

OracleServer:/home/hri> which kill
/bin/kill

OracleServer:/home/hri> l /bin/kill
-rwxr-xr-x 1 root root 14864 Sep 22  2010 /bin/kill

OracleServer:/home/hri> file /bin/kill
/bin/kill: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

Edit, thanks to jjlin comment:

It is hri user who started the $ORACLE_SID (this is what is shown on the first session log posted).

Permissions on oracle binary shown a suid and sgid set.

OracleServer:/home/hri> l /oracle/product/10.2.0.5/bin/oracle
-rwsr-s--x 1 oracle dba 116208733 Jul  1 09:29 /oracle/product/10.2.0.5/bin/oracle

And indeed, the /proc/*/status's Uid line shows that Real UID is 20314 (which is the user id of hri) while Effective UID is 20001 (which is oracle).

OracleServer:/home/hri> ps auxf | grep HRIXXX | grep 9609
oracle    9609  0.0  0.0 759668 19692 ?        Ss   08:41   0:00 ora_pmon_HRIXXXDW

OracleServer:/home/hri> grep [UG]id: /proc/9609/status
Uid:    20314   20001   20001   20001
Gid:    20175   20001   20001   20001

So it must be that: Oracle does run its System ID (SID) sub-processes as Real UID of database owner, while the Effective UID is Oracle's.

Thank you!

References:

share|improve this question
1  
What are the permissions on your oracle executable, and did user hri start your Oracle instance? –  jjlin Dec 12 '13 at 23:24
1  
@MathieuMD Since you seem to have figured this out, posting your own answer would be a good idea. –  allquixotic Dec 13 '13 at 18:16

1 Answer 1

up vote 1 down vote accepted

Oracle runs its SID sub-processes as Real UID of database owner (hri here), while the Effective UID is Oracle's (oracle). Which is why hri was able to kill what was actually its own processes.

You can use ps axf -O ruid,ruser,euid,euser to display side-by-side both RUID and EUID.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.