IC71378: ONSHOWAUDIT DOES NOT PROCESS AUDIT TRAIL FILES OWNED BY ROOT:INFORMIX.

APAR status

• Closed as fixed if next.

Error description

• If the audit trail file is owned by root with group informix,
  the onshowaudit utility does not process the file and displays a
  warning message as follows:
  
   =>onshowaudit -I -f demo_on.32 -l
  ONSHOWAUDIT Secure Audit Utility
  INFORMIX-SQL Version 11.50.FC5WM1
  Cannot open file demo_on.32
  

Local fix

• Change the owner of the audit trail file to informix:informix.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users trying to read audit log files owned by root.          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Since onshowaudit is SUID root/SGID informix there was a     *
  * restriction put is so that onshowaudit could not be used to  *
  * read privileged files - e.g. /etc/shadow.                    *
  * The root privilege is a vestige of OS auditing which is no   *
  * longer supported.                                            *
  * Changed onshowaudit to revoke the SUID/SGID privileges and   *
  * run as the user that started it.                             *
  * Because of this, restriction on files is no longer           *
  * necessary, you can process any file you can read.            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Install the patch.                                           *
  * The ultimate fix will be to remove the SUID/SGID privilege   *
  * from onshowaudit.                                            *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

• For download information, go to:
  http://www.ibm.com/support/fixcentral
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• RB15 PSN

     UP