9:29 a.m.
I have a RHEL4U4 server that will become an Oracle 10gR2 server in three
weeks. Almost all of the documentation I have seen about installing oracle
on a selinux enabled server says to turn off selinux. Only 1 document said
that oracle and selinux can function together. So can oracle and selinux
play nice or do I have to turn it off?
Thanks,
Adam
_________________________________________________________________
Find sales, coupons, and free shipping, all in one place! MSN Shopping
Sales & Deals
http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
2:45 p.m.
Jack Null wrote:
I have a RHEL4U4 server that will become an Oracle 10gR2 server in
three weeks. Almost all of the documentation I have seen about
installing oracle on a selinux enabled server says to turn off
selinux. Only 1 document said that oracle and selinux can function
together. So can oracle and selinux play nice or do I have to turn it
off?
They should be able to play nice. The only place they might hit would
be if there is a web interface.
Oracle might also be seeking to eek out every bit of performace.
SELinux can add some load between 2-20% depending on which performance
test you run.
Thanks,
Adam
_________________________________________________________________
Find sales, coupons, and free shipping, all in one place! MSN
Shopping Sales & Deals
http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
4:45 p.m.
Daniel J Walsh wrote:
Jack Null wrote:
> I have a RHEL4U4 server that will become an Oracle 10gR2 server in
> three weeks. Almost all of the documentation I have seen about
> installing oracle on a selinux enabled server says to turn off
> selinux. Only 1 document said that oracle and selinux can function
> together. So can oracle and selinux play nice or do I have to turn
> it off?
They should be able to play nice. The only place they might hit would
be if there is a web interface.
Oracle might also be seeking to eek out every bit of performace.
SELinux can add some load between 2-20% depending on which performance
test you run.
>
> Thanks,
> Adam
>
> _________________________________________________________________
> Find sales, coupons, and free shipping, all in one place! MSN
> Shopping Sales & Deals
> http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
"Oracle might also be seeking to eek out every bit of performace.
SELinux can add some load between 2-20% depending on which performance
test you run."
I thoht SELinux's overhead was only for the transitions and file access
thereby being a small amount of this total time (est. at 7% untuned.)
The web app would be using Oracle's security with a MyWebAppUsername.
Yes / No?
Could you explain this overhead and where and what is doing it, please.
I don't see where it would be any greater than 7% of the volume of
transitions and file accesses (which would be different web files. And
that would be an Apache overhead whether a DBMS was being used or not.
Thank you,
Darwin
10:52 a.m.
Darwin H. Webb wrote:
Daniel J Walsh wrote:
> Jack Null wrote:
>> I have a RHEL4U4 server that will become an Oracle 10gR2 server in
>> three weeks. Almost all of the documentation I have seen about
>> installing oracle on a selinux enabled server says to turn off
>> selinux. Only 1 document said that oracle and selinux can function
>> together. So can oracle and selinux play nice or do I have to turn
>> it off?
> They should be able to play nice. The only place they might hit
> would be if there is a web interface.
> Oracle might also be seeking to eek out every bit of performace.
> SELinux can add some load between 2-20% depending on which
> performance test you run.
>>
>> Thanks,
>> Adam
>>
>> _________________________________________________________________
>> Find sales, coupons, and free shipping, all in one place! MSN
>> Shopping Sales & Deals
>> http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
>>
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>
"Oracle might also be seeking to eek out every bit of performace.
SELinux can add some load between 2-20% depending on which performance
test you run."
I thoht SELinux's overhead was only for the transitions and file
access thereby being a small amount of this total time (est. at 7%
untuned.)
All access is being checked including things like network traffic. So
if the application is doing something the kernel would require an access
check on, SELinux will have some overhead. The 20% figure, I believe,
comes from Network through put tests. So running a router with SELinux
might not be a great idea.
The web app would be using Oracle's security with a MyWebAppUsername.
Yes / No?
Could you explain this overhead and where and what is doing it, please.
I don't see where it would be any greater than 7% of the volume of
transitions and file accesses (which would be different web files. And
that would be an Apache overhead whether a DBMS was being used or not.
Thank you,
Darwin
3:04 p.m.
Daniel J Walsh wrote:
Darwin H. Webb wrote:
> Daniel J Walsh wrote:
>> Jack Null wrote:
>>> I have a RHEL4U4 server that will become an Oracle 10gR2 server in
>>> three weeks. Almost all of the documentation I have seen about
>>> installing oracle on a selinux enabled server says to turn off
>>> selinux. Only 1 document said that oracle and selinux can function
>>> together. So can oracle and selinux play nice or do I have to turn
>>> it off?
>> They should be able to play nice. The only place they might hit
>> would be if there is a web interface.
>> Oracle might also be seeking to eek out every bit of performace.
>> SELinux can add some load between 2-20% depending on which
>> performance test you run.
>>>
>>> Thanks,
>>> Adam
>>>
>>> _________________________________________________________________
>>> Find sales, coupons, and free shipping, all in one place! MSN
>>> Shopping Sales & Deals
>>> http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
>>>
>>>
>>> --
>>> fedora-selinux-list mailing list
>>> fedora-selinux-list(a)redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
>>
> "Oracle might also be seeking to eek out every bit of performace.
> SELinux can add some load between 2-20% depending on which
> performance test you run."
>
> I thoht SELinux's overhead was only for the transitions and file
> access thereby being a small amount of this total time (est. at 7%
> untuned.)
All access is being checked including things like network traffic. So
if the application is doing something the kernel would require an
access check on, SELinux will have some overhead. The 20% figure, I
believe, comes from Network through put tests. So running a router
with SELinux might not be a great idea.
>
> The web app would be using Oracle's security with a MyWebAppUsername.
> Yes / No?
>
> Could you explain this overhead and where and what is doing it, please.
> I don't see where it would be any greater than 7% of the volume of
> transitions and file accesses (which would be different web files.
> And that would be an Apache overhead whether a DBMS was being used or
> not.
>
> Thank you,
>
> Darwin
>
The tests at this link show about an overall 7%.
http://people.redhat.com/jmorris/selinux/bench/results/summary.txt
The only 2 tests that look strange are pipes and the 2 procs tbench tests.
This is from 2003, do you know if anyone has run this again with the
newer security checks and gncc 4.1.1?
These 2 tests could have been a fluc (1,3,4 procs were not affected.)
The overhead of SELinux would increase proportional to the volume, but
not increase dis-proportionally except for possibly some interaction at
some load point near total saturation of most resources, This usually is
a sign of queues being dumped and reestablished.
Darwin
2:35 p.m.
Darwin H. Webb wrote:
Daniel J Walsh wrote:
> Darwin H. Webb wrote:
>> Daniel J Walsh wrote:
>>> Jack Null wrote:
>>>> I have a RHEL4U4 server that will become an Oracle 10gR2 server in
>>>> three weeks. Almost all of the documentation I have seen about
>>>> installing oracle on a selinux enabled server says to turn off
>>>> selinux. Only 1 document said that oracle and selinux can
>>>> function together. So can oracle and selinux play nice or do I
>>>> have to turn it off?
>>> They should be able to play nice. The only place they might hit
>>> would be if there is a web interface.
>>> Oracle might also be seeking to eek out every bit of performace.
>>> SELinux can add some load between 2-20% depending on which
>>> performance test you run.
>>>>
>>>> Thanks,
>>>> Adam
>>>>
>>>> _________________________________________________________________
>>>> Find sales, coupons, and free shipping, all in one place! MSN
>>>> Shopping Sales & Deals
>>>> http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639
>>>>
>>>>
>>>> --
>>>> fedora-selinux-list mailing list
>>>> fedora-selinux-list(a)redhat.com
>>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>>
>>> --
>>> fedora-selinux-list mailing list
>>> fedora-selinux-list(a)redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>>
>>>
>> "Oracle might also be seeking to eek out every bit of performace.
>> SELinux can add some load between 2-20% depending on which
>> performance test you run."
>>
>> I thoht SELinux's overhead was only for the transitions and file
>> access thereby being a small amount of this total time (est. at 7%
>> untuned.)
> All access is being checked including things like network traffic.
> So if the application is doing something the kernel would require an
> access check on, SELinux will have some overhead. The 20% figure, I
> believe, comes from Network through put tests. So running a router
> with SELinux might not be a great idea.
>>
>> The web app would be using Oracle's security with a
>> MyWebAppUsername. Yes / No?
>>
>> Could you explain this overhead and where and what is doing it, please.
>> I don't see where it would be any greater than 7% of the volume of
>> transitions and file accesses (which would be different web files.
>> And that would be an Apache overhead whether a DBMS was being used
>> or not.
>>
>> Thank you,
>>
>> Darwin
>>
>
>
>
The tests at this link show about an overall 7%.
http://people.redhat.com/jmorris/selinux/bench/results/summary.txt
The only 2 tests that look strange are pipes and the 2 procs tbench
tests.
This is from 2003, do you know if anyone has run this again with the
newer security checks and gncc 4.1.1?
These 2 tests could have been a fluc (1,3,4 procs were not affected.)
The overhead of SELinux would increase proportional to the volume, but
not increase dis-proportionally except for possibly some interaction
at some load point near total saturation of most resources, This
usually is a sign of queues being dumped and reestablished.
Darwin
I hope to publish some more extensive performance tests on RHEL5 by the
end of the week.
1:19 p.m.
Hello again,
I was able to install Oracle 10gR2 on RHEL4U4 with selinux in targeted
enforcing mode. No selinux messages in /var/log/messages or dmesg. I found
a couple of scripts that will start and shutdown the database and enterprise
manager on boot and shutdown. I had a couple of problems with this part and
I am not sure if selinux is the problem or not. Let me explain then I will
post the code.
I created a file called oracle in /etc/rc.d/init.d. I ran chkconfig oracle
reset. I then ran service oracle start. The database wouldn't start.
oracle calls the script dbstart which needs ORACLE_HOME defined. If I add a
export ORACLE_HOME=/path/to/oracle to dbstart everything works. If I remove
the export then the database won't start. I was under the assumption that
when I set ORACLE_HOME in oracle it would be able to be used by dbstart.
This does not appear to be true. Is this a selinux problem, or did I
misunderstand something? To get the database to start I added the export
ORACLE_HOME to /etc/profile. Also when I do a init 6 or init 0 the oracle
service doesn't shutdown i.e. no shutting down oracle ................
Thanks,
#!/bin/bash
#
# chkconfig: 35 95 1
# description: init script to start/stop oracle database 9i, TNS listener,
EMS
#
# DON'T FORGET TO MODIFY /etc/oratab AND CHANGE THE LAST VARIBLE TO Y
# chmod 750 this file
export ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_1
export ORACLE_BIN=$ORACLE_HOME/bin
export ORACLE_SID=jrd
export LD_LIBRARY_PATH=$ORACLE_HOME/lib
export ORACLE_USER=oracle
export PATH=$PATH:$ORACLE_BIN
if [ ! -f $ORACLE_BIN/dbstart ]
then
echo "Oracle startup: cannot start"
exit
fi
# see how we are called:
case $1 in
start)
su - $ORACLE_USER -c $ORACLE_BIN/dbstart
# su - $ORACLE_USER -c "$ORACLE_BIN/emctl start dbconsole"
;;
stop)
# su - $ORACLE_USER -c "$ORACLE_BIN/emctl stop dbconsole"
su - $ORACLE_USER -c $ORACLE_BIN/dbshut
;;
*)
echo "Usage: $0 {start|stop}"
;;
esac
_________________________________________________________________
Invite your Hotmail contacts to join your friends list with Windows Live
Spaces
http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://...
7:47 a.m.
Adam Turk wrote:
Hello again,
I was able to install Oracle 10gR2 on RHEL4U4 with selinux in targeted
enforcing mode. No selinux messages in /var/log/messages or dmesg. I
found a couple of scripts that will start and shutdown the database
and enterprise manager on boot and shutdown. I had a couple of
problems with this part and I am not sure if selinux is the problem or
not. Let me explain then I will post the code.
I created a file called oracle in /etc/rc.d/init.d. I ran chkconfig
oracle reset. I then ran service oracle start. The database wouldn't
start. oracle calls the script dbstart which needs ORACLE_HOME
defined. If I add a export ORACLE_HOME=/path/to/oracle to dbstart
everything works. If I remove the export then the database won't
start. I was under the assumption that when I set ORACLE_HOME in
oracle it would be able to be used by dbstart. This does not appear
to be true. Is this a selinux problem, or did I misunderstand
something? To get the database to start I added the export
ORACLE_HOME to /etc/profile. Also when I do a init 6 or init 0 the
oracle service doesn't shutdown i.e. no shutting down oracle
................
I would doubt this is an SELinux problem. You can always check for avc
messages in /var/log/messages. You can also temporarily turn off
enforcing mode "setenforce 0", then try it. If it is still broken while
SELinux is in permissive mode, it is most likely not an SELinux problem.
Thanks,
#!/bin/bash
#
# chkconfig: 35 95 1
# description: init script to start/stop oracle database 9i, TNS
listener, EMS
#
# DON'T FORGET TO MODIFY /etc/oratab AND CHANGE THE LAST VARIBLE TO Y
# chmod 750 this file
export ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_1
export ORACLE_BIN=$ORACLE_HOME/bin
export ORACLE_SID=jrd
export LD_LIBRARY_PATH=$ORACLE_HOME/lib
export ORACLE_USER=oracle
export PATH=$PATH:$ORACLE_BIN
if [ ! -f $ORACLE_BIN/dbstart ]
then
echo "Oracle startup: cannot start"
exit
fi
# see how we are called:
case $1 in
start)
su - $ORACLE_USER -c $ORACLE_BIN/dbstart
# su - $ORACLE_USER -c "$ORACLE_BIN/emctl start dbconsole"
;;
stop)
# su - $ORACLE_USER -c "$ORACLE_BIN/emctl stop dbconsole"
su - $ORACLE_USER -c $ORACLE_BIN/dbshut
;;
*)
echo "Usage: $0 {start|stop}"
;;
esac
_________________________________________________________________
Invite your Hotmail contacts to join your friends list with Windows
Live Spaces
http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://...
1:48 p.m.
From: Daniel J Walsh <dwalsh(a)redhat.com>
>Adam Turk wrote:
>Hello again,
>
>I was able to install Oracle 10gR2 on RHEL4U4 with selinux in targeted
>enforcing mode. No selinux messages in /var/log/messages or dmesg. I
>found a couple of scripts that will start and shutdown the database and
>enterprise manager on boot and shutdown. I had a couple of problems with
>this part and I am not sure if selinux is the problem or not. Let me
>explain then I will post the code.
>
>I created a file called oracle in /etc/rc.d/init.d. I ran chkconfig
>oracle reset. I then ran service oracle start. The database wouldn't
>start. oracle calls the script dbstart which needs ORACLE_HOME defined.
>If I add a export ORACLE_HOME=/path/to/oracle to dbstart everything works.
> If I remove the export then the database won't start. I was under the
>assumption that when I set ORACLE_HOME in oracle it would be able to be
>used by dbstart. This does not appear to be true. Is this a selinux
>problem, or did I misunderstand something? To get the database to start I
>added the export ORACLE_HOME to /etc/profile. Also when I do a init 6 or
>init 0 the oracle service doesn't shutdown i.e. no shutting down oracle
>................
>
I would doubt this is an SELinux problem. You can always check for avc
messages in /var/log/messages. You can also temporarily turn off enforcing
mode "setenforce 0", then try it. If it is still broken while SELinux is
in permissive mode, it is most likely not an SELinux problem.
SELinux is not causing the environmnet variable problem I discribed. I will
leave the ORACLE_HOME in /etc/profile and call it done.
On a side note, shouldn't selinux messages go into a /var/log/selinux file
instead of messages?
Thanks,
_________________________________________________________________
From predictions to trailers, check out the MSN Entertainment Guide to
the
Academy Awards®
http://movies.msn.com/movies/oscars2007/?icid=ncoscartagline1
3:26 p.m.
Adam Turk wrote:
> From: Daniel J Walsh <dwalsh(a)redhat.com>
>> Adam Turk wrote:
>> Hello again,
>>
>> I was able to install Oracle 10gR2 on RHEL4U4 with selinux in
>> targeted enforcing mode. No selinux messages in /var/log/messages
>> or dmesg. I found a couple of scripts that will start and shutdown
>> the database and enterprise manager on boot and shutdown. I had a
>> couple of problems with this part and I am not sure if selinux is
>> the problem or not. Let me explain then I will post the code.
>>
>> I created a file called oracle in /etc/rc.d/init.d. I ran chkconfig
>> oracle reset. I then ran service oracle start. The database
>> wouldn't start. oracle calls the script dbstart which needs
>> ORACLE_HOME defined. If I add a export ORACLE_HOME=/path/to/oracle
>> to dbstart everything works. If I remove the export then the
>> database won't start. I was under the assumption that when I set
>> ORACLE_HOME in oracle it would be able to be used by dbstart. This
>> does not appear to be true. Is this a selinux problem, or did I
>> misunderstand something? To get the database to start I added the
>> export ORACLE_HOME to /etc/profile. Also when I do a init 6 or init
>> 0 the oracle service doesn't shutdown i.e. no shutting down oracle
>> ................
>>
> I would doubt this is an SELinux problem. You can always check for
> avc messages in /var/log/messages. You can also temporarily turn off
> enforcing mode "setenforce 0", then try it. If it is still broken
> while SELinux is in permissive mode, it is most likely not an SELinux
> problem.
SELinux is not causing the environmnet variable problem I discribed.
I will leave the ORACLE_HOME in /etc/profile and call it done.
On a side note, shouldn't selinux messages go into a /var/log/selinux
file instead of messages?
In RHEL5 they go to /var/log/audit/audit.log if auditing is turned on.
Thanks,
_________________________________________________________________
From predictions to trailers, check out the MSN Entertainment Guide to
the Academy Awards®
http://movies.msn.com/movies/oscars2007/?icid=ncoscartagline1
6300
days inactive
6321
days old
selinux@lists.fedoraproject.org
9 comments
3 participants
participants (3)
-
bastard operater -
Daniel J Walsh -
Darwin H. Webb