使用crs_setperm修改RAC资源的所有者及权限

Oracle RAC 集群中,对于各种资源的管理,也存在所有者与权限的问题。crs_getperm与crs_setperm则是这样的一对命令,主要用于查看与修改集群中resource的owner,group以及权限等,下面通过具体的演示来获得其使用方法。

1、查看当前集群中的资源 
#下面的查询可知,当前集群环境中存在两个service 
oracle@bo2dbp:~> crs_stat -ls | grep srv 
ora....O4A.srv oracle        oinstall                rwxrwxr-- 
ora....0g1.srv oracle        oinstall                rwxrwxr-- 
 
#获得service的全称 
oracle@bo2dbp:~> crs_stat -p | grep srv 
NAME=ora.GOBO4.GOBO4_SRV.GOBO4A.srv 
NAME=ora.ora10g.hr_ora10g.ora10g1.srv 
DESCRIPTION=ora.ora10g.hr_ora10g.ora10g1.srv 
 
#下面通过crs_getperm获得资源的所有者即权限 
oracle@bo2dbp:~> crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:oracle:rwx,pgrp:oinstall:rwx,other::r--, 
#上面owner即为所有者,pgrp表示所有者,other则为其他用户,每个后面跟的都是其对应的权限 
 
2、crs_getperm与crs_setperm的用法 
 
oracle@bo2dbp:~> crs_getperm -h 
Usage: crs_getperm resource_name [-u user|-g group] [-q] 
#crs_getperm用法较为简单,后面接资源名,可选的为用户或组 
 
oracle@bo2dbp:~> crs_setperm -h  #此命令稍微较crs_getperm复杂 
Usage: crs_setperm resource_name -u aclstring [-q] 
      crs_setperm resource_name -x aclstring [-q] 
      crs_setperm resource_name -o user_name [-q] 
      crs_setperm resource_name -g group_name [-q] 
 
      -u  Update the acl string 
      -x  Delete the acl string 
      -o  Change the owner of the resource 
      -g  Change the primary group of the resource 
 
      aclstring is one of the following: 
      user:<username>:rwx 
      group:<groupname>:r-x  #当心这里的group用法,如果直接使用group修改权限会收到错误提示 
      other::r-- 
 
3、演示使用crs_setperm 
oracle@bo2dbp:~> su 
Password: 
#下面分别修改资源hr_ora10g的资源所有者和所属组,将其全部改为roo权限 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -o root 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -g root   
 
#查看修改之后,该资源的属主与属组已经发生变化 
bo2dbp:/users/oracle # crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:root:rwx,pgrp:root:rwx,other::r--, 
 
#修改属组的权限,将其改为读,执行 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u pgrp:root:r-x 
bo2dbp:/users/oracle # crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:root:rwx,pgrp:root:r-x,other::r--, 
 
#使用同样的方式将其修改回去。 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -o oracle 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -g oinstall 
bo2dbp:/users/oracle # crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u pgrp:oinstall:rwx 
 
bo2dbp:/users/oracle # crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:oracle:rwx,pgrp:oinstall:rwx,other::r--, 
 
bo2dbp:/users/oracle # su - oracle 
#所有者的权限不允许修改 
oracle@bo2dbp:~> crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u owner:oracle:r-x 
CRS-0248:  Acl operation failed 
 
oracle@bo2dbp:~> crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u owner:oracle:rw- 
CRS-0248:  Acl operation failed 
 
oracle@bo2dbp:~> crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u owner:oracle:-wx 
CRS-0248:  Acl operation failed 
 
#组权限可以修改 
oracle@bo2dbp:~> crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u pgrp:oinstall:r-x 
 
oracle@bo2dbp:~> crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:oracle:rwx,pgrp:oinstall:r-x,other::r--, 
 
#other也可以修改 
oracle@bo2dbp:~> crs_setperm ora.ora10g.hr_ora10g.ora10g1.srv -u other::rwx   
oracle@bo2dbp:~> crs_getperm ora.ora10g.hr_ora10g.ora10g1.srv 
Name: ora.ora10g.hr_ora10g.ora10g1.srv 
owner:oracle:rwx,pgrp:oinstall:r-x,other::rwx, 
 
#Author: Robinson   
#根据下面的查看结果可知,已经发生了变化,建议将其改为最初的状态 
oracle@bo2dbp:~> crs_stat -ls |grep srv 
ora....O4A.srv oracle        oinstall                rwxrwxr-- 
ora....0g1.srv oracle        oinstall                rwxr-xrwx   

相关推荐