See presence state of non-jabber user

Hi all,
probably stupid question but : can you see the presence state of a (IM&P enabled) user that only has an IP phone and no Jabber client? Running UCM/IMP release 9.1.2
I would think so, as UCM should publish presence state of that user phone line, but I can NOT see the presence state for these users in Jabber :S
The in/out security ACL on IM&P server has the IP address of UCM servers listed, so it accepts PUBLISH from them.
The user without Jabber is enabled for IM&P in the UCM enduser pages
The phone line appearance is associated to the user
For Jabber users, I can see physical phone presence state(on/offhoook)
Any feedback is appreciated !
Juan

Hi,
SM12 is for displaying and deleting locks. It won't help to check the logon status of non-dialog users. My doubt is whether non-dialog users have specific logon status or not.
Thanks & Regards,
Vishnu Priya

Similar Messages

Can't see db portlets as non authorized user

Hi,
I created portal db providers - reports and forms and put them on a page. I have checked "Display Page To Public Users". When I log in, I can see the portlets, but without logging in I can't see them.
Thanks for help.
Brano

Hi,
It is not enough if you grant the page to public. The whole application or the portlets on the page should be granted to public.
Thanks,
Sharmila

TS3999 icloud and non icloud users can't see invitations

I am using icloud and have turned off all of the ON MY MAC calendars as that was causing duplicates and a host of syncing issues when I did not select the right calendar.
It seems that when a non icloud user sends me an invite (mac user) that they do not appear, even as an email. Vice versa is also happening when I send a calendar invite to a non icloud user, they do not see my invitation.
What's the solution.

I am using icloud and have turned off all of the ON MY MAC calendars as that was causing duplicates and a host of syncing issues when I did not select the right calendar.
It seems that when a non icloud user sends me an invite (mac user) that they do not appear, even as an email. Vice versa is also happening when I send a calendar invite to a non icloud user, they do not see my invitation.
What's the solution.

One user can't see presence and send IM to one specific colleague

Hi there
One of our J4W users have a very strange issue, but it's only affected that user (at least what I know of).
The user can't see presence status or send a IM to one specific user. If she tries to send a PM, she gets this message: "Message to <person> could not be delivered".
However, she can see presence and send IM's to other users just fine.
I have tried with version 9.1.2/3 . I have not seen this issue on other users.
J4W 9.1.X
Windows 7 Enterprise 32 bit
CUP: 8.6.2.10000-44
CUCM: 8.6.2.22900-9
AD 2008 R2
Is this also a J4W software defect or what could it be?
Thanks
Kristian

Hi both of you.
Yes you are right, our CUP domain is not the same as our email domain. I guess I have to change the CUP domain then. Do you know any guides to do this? I guess I have to restart the CUP server after changing domain?
We are also seeing inconsistences that can arise from adding Outlook contacts, so this should solve alot of issues for us.
I hope it will fix the issues
Thanks

Is Lightroom intentionally made difficult for non-English users?

Could it be that Lightroom is intentionally made difficult for the non-English user? I came to this forum today hoping to find an answer and all I see is problems when I try searching the forum, and complicated instructions on how to, supposdely, solve this issue. The issue I am facing has to do with localization, compatibility, interoperability and compliance. The problem is that I can't use many of the Lightroom shortcuts. Many of the ones that require the use of a modifier key on my keyboard just don't work. So what if I have a Swedish keyboard? Sweden is one of the most computer literate contries in the world, and Sweden has played a major role in the development of early computers and new technologies. Adobe has a presence in this country, and I'm quite sure Sweden is an important market for Adobe. So why not make Lightroom compatible with the Swedish keyboard? Why should I care to go through complicated instructions on how to hacktivate my keyboard by the means of editing config or script files? Why can't it just work out of the box?
I feel like this is intentional. Could it be that Lightroom users are only to be found in English speaking countries like USA, UK, New Zealand and Australia? I don't think so.
Swedish user:
http://forums.adobe.com/message/1459525#1459525
Swiss user:
http://forums.adobe.com/message/4375318#4375318
German user:
http://forums.adobe.com/message/3588746#3588746
http://forums.adobe.com/message/3817657#3817657
How about the ability to change keyboard shortcut bindings, i.e. custom shortcuts? I just found that this is not even possible in Lightroom! That explains why people take these strange measures and kludgy ways of making custom shortcuts in Lightroom. Changing shortcuts is often times tricky business because you have to change them in respect to other shortcuts. It's likely that one will have to change several keyboard shortcuts to avoid conflicts, etc. Lightroom needs a shortcut editor!
One should really not even have to change the default shortcuts, Adobe should choose some intelligent key combinations that make sense, and they should just work on any keyboard. I've tried changing the language from English to Swedish in Lightroom settings. The result of this is that nearly all shortcuts are changed to something else, so I would have to re-learn some of the shortcuts I have already learned using Lightroom in English, and of course this also changes the language of the interface which is not something I want. I will have to change my keyboard layout to English to make this work, or get a secondary keyboard, one with English layout. This is something I will only have to do when I work in Lightroom, because many of the professional programs that I use are working just fine with my keyboard. Perhaps Adobe can make the keyboard localization (shortcut maps) as an option, separate from the interface language setting? And for God sake integrate a keyboard shortcut editor for once!

Another Swiss user on Lightroom forums:
http://www.lightroomforums.net/showthread.php?6867-Flippy-Key-Using-Lightroom-in-english-w ith-a-non-english-keyboard-layout
I ended up removing the Keyboard Tamer plugin and then manually adding following strings to C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\en\TranslatedStrings.txt. This is by the way something that the Keyboard Tamer plugin does as well, because when I removed it I found two files named TranslatedStrings.txt in the Recycle Bin. The Keyboard Tamer is just supposed to save you the time and effort of manually manipulating these strings.
"$$$/AgLibrary/Menu/View/ZoomIn=Zoom In"
"$$$/AgLibrary/Menu/View/ZoomIn/Key=Cmd+."
"$$$/AgLibrary/Menu/View/ZoomInMinor=Slow Zoom In"
"$$$/AgLibrary/Menu/View/ZoomInMinor/Key=Cmd+Shift+."
"$$$/AgLibrary/Menu/View/ZoomOut=Zoom Out"
"$$$/AgLibrary/Menu/View/ZoomOut/Key=Cmd+-"
"$$$/AgLibrary/Menu/View/ZoomOutMinor=Slow Zoom Out"
"$$$/AgLibrary/Menu/View/ZoomOutMinor/Key=Cmd+Shift+-"
I found this thread helpful:
http://forums.adobe.com/message/1459525#1459525#1459525
I just replaced AgDevelop with AgLibrary. This of course only changes the key binding for Zoom In and Zoom Out in the Library module. Is there perhaps a document somewhere that explains the structure of the TranslatedStrings.txt file? There seems to be one of these files in each of the language specific folders under the Resources folder.
This file is known to be found in:
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources>dir /b /s TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\de\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\en\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\es\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\fr\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\it\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\ja\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\ko\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\nl\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\pt\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\sv\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\zh_cn\TranslatedStrings.txt
C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\zh_tw\TranslatedStrings.txt
I will study the structure of this file in Resources\sv\ and try to understand it. And as I find new "flaws" in the shortcut key bindings I will make new edits to the file I saved in Resources\en\ accordingly.
Here's an idea: those of you who don't mind re-learning all the shortcuts - the localized shortcuts for Swedish keyboards - simply copy the TranslatedStrings.txt file from C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\sv\ and paste it in C:\Program Files\Adobe\Adobe Photoshop Lightroom 4\Resources\en\. What this does it allows you to keep English as your interface language, but it changes the shortcut map to something that's more adopted for the Swedish keyboard layout. You get the same shortcut key bindings as the ones you see when you change the language to Swedish in the settings. But this way you are preventing Lightroom from changing the interface language.
Either that, or add new strings to an empty Resources\en\TranslatedStrings.txt file for each key binding you find to be broken and not compatible with your keyboard. This way you are only making changes to the key bindings that don't work very well for your keyboard, you are not chaning all of the shortcut key bindings. The other key bindings stay the same, the default key bindings found in the English version of Lightroom (or with English as language settings).
This is a way to adapt Lightroom for your own environment. But this is still too complicated and unncessary. A simple shortcut editor built into Lightroom would have solved this. But what are we going to do?... this is up to Adobe... Lightrooms have been complaining about the lack of a shortcut editor since at least Lightroom 2 and Adobe has not listened. So I don't expect to see this feature in the following years to come. It might just come along in maybe Lightroom version seven or something... but who cares?... At that time I might even ditch Lightroom altogether.
Ligthroom 5 upgrade...
I just found out that the new Lightroom 5 is not compatible with Windows Vista. I have the Vista Ultimate 64-bit on my desktop where I use Lightroom. This was not made very clear by Adobe. They simply state that Lightroom 5 works on Mac and on Windows. You have to read the fine print. I almost purchased the upgrade. I'm glad I didn't. I won't upgrade from Vista to Windows 7 just to run Lightroom 5! We, the early Windows Vista adapters, got screwed by Microsoft. Now, we are getting screwed by Adobe too! I see no reason not to support Windows Vista as it is pretty much the same system as Windows 7, and one would expect Adobe to support them both. I found a thread about it where one user asked why Vista was not supported and Adobe failed to give any explanation. They just silently dropped the OS support.
I guess they can do whatever they want. They are Adobe.
But I will not upgrade to Windows 7 because of Lightroom, so I won't upgrade to Lightroom 5. This is a great oppertunity for Phase One to strike with a good deal, such as a discounted migration upgrade for Capture One. I am sure many Lightroom 4 users would be happy to leave the Lightroom ship in favor of Capture One. At the end of life of Lightroom 4 I will probably just go to Capture One, even if I have to pay full price. At least they support Windows Vista.

Jabber cannot do voice calls to PSTN or to other jabber user

Hi,
I'm trying to troubleshoot why jabber for windows 9.7.2 is not able to establish calls to PSTN dialed by DN and to other jabber user called by URI, not DN.
We have CUCM 10 with IM and Presence 10. IM and Presence is newly installed. I have created 2 x Cisco Unified Client Services Framework devices for 2 users. Users are able to connect through jabber for windows, IM, do direct DN-to-DN calls (including video), but not able to call outside to PSTN and by URI to other users.
Cases:
- jabber for windows - call DN to DN between internal users - working with video
- jabber for windows - call DN to PSTN through SIP-to-SIP connection (SIP trunk to GW, SIP trunk from GW to ISP) - not working CUCM returning me Q.850 cause 65 to jabber immediately when other side pick up phone, even jabber hear ringing with music from ISP side. - Cause: 65(0x41)[Bearer capability not implemented]
- jabber for windows - in search field I search for second user, I can see presence, when I click call button, call is immediately dropped - don't know reason still not troubleshooted.
communication between GW 2801 and ISP is OK, they are acknowledge codec and everything is fine.
EDIT: I tried to connect jabber for windows directly to CUCM TFTP servers without IM and Presense server. I have same behavior, when outgoing call is picked up it is immediately dropped by CUCM and send Q.850 cause 65 to jabber.
EDIT2: any other SIP device configured same way as jabber CSF is working. just jabber not.
EDIT3: when I selected "Media Termination Point required" on jabber device in CUCM, then voice is working normally. But if possible I do not want this and make voice without MTP. How?
THanks

I found it, i have enabled "Allow Presentation Sharing using BFCP" on SIP profile assigned to trunk pointing to voice gateway. This causes that SDP from gateway didn't come.

How can I share my calendars (presently on shared on iCloud) with the public (non iCloud users)?

I have just upgraded to 10.9 OS and shared my calendars with iCloud. I would like to make them public and get a url that so non iCloud users can see them. When I click on the "public" calendar checkbox and email the link I am given, I try to test it and it is not an "https://" address, but a "webcal://" which just reopens iCal and asks me if I want to subscribe.
Please let me know what I can do to get this to work.
I am hoping that iCal has not changed and is no longer available for public sharing.

Hi Norm,
I sent this invite to my gmail account as a test, both as a public shared view only and editable calendar and received the same message in both cases. As you can see the email states that I need to be an icloud member.
What is the next step to fix this?

How do I get imessage to send SMS texts to non iphone users?

I have read that I can use imessage to send and receive regulr SMS text messages to non iphone users; but, I can't seem to make it work. When I try to enter a mobile number of a non iphone user in the new text address bar and send anSMS text the adressee turns red and I get the following message:
Your message could not be sent.
4342496xxx is not registered with iMessage.
Does anyone have a suggestion? I've checked my preferences and any articles I could find but so far I can't find anything that helps. Thanks.

Hi,
As I said the Menu Item has disappeared in Messages but you can still get it to send SMS Messages via an AIM Account to a "Buddy" that is the phone number with a leading + 1 for the country code (although it was never rolled out world wide).
Uploaded with Skitch!
The Menu items in the Buddies menu (This is from iChat 5) do not appear unless the computer ius set to be in the United States.
They don't appear at All in Messages (whether the computer is set or not.)
This Info card to show it has numbers
Uploaded with Skitch!
I see you have eventually got there with willar's post.
For the points
8:21 PM Monday; October 8, 2012
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
 iMac 2.5Ghz 5i 2011 (Mountain Lion 10.8.2)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
 Couple of iPhones and an iPad
"Limit the Logs to the Bits above Binary Images."  No, Seriously

Can't see Presence Status after contact remove

Hi Folks,
We just install CUCM 9.0 and CUCM IM and Presence 9.0 also.
We are using Cisco jabber clients for Windows (9.1) and we're experiencing strange behavior (at least a different behavior than version 8.5 of Presence server).
Here it is:
GuyA and GuyB are both using CUPC. GuyA has GuyB in his contact list, and GuyB has GuyA also in his contact list.
If GuyA remove GuyB from his contact list, then GuyB can't see GuyA online anymore..!?
I never see this behavior before in older CUPS release and I'm wondering if something change or if I'm missing something in the server config.
I'm using only one Presence Group for all the users and everyone have the correct Subscribed CSS.
Any idea ?
Thank you
Regards
Fabian

Anyone ?
Thanks
Fabian

HT3529 On ipad3, wifi only, how can I send messages to non iOS users?

On ipad3, wifi only, how can I send messages to non iOS users?
I have MacBook, and iPhone 4 as well

Your're wrong on the overly sensitive part. I couldn't care less about android or some other stuff that you are comparing, what i do care about... enough to take the time to explain, is that your view on things colors the choices you make.
You clearly state your decision making process and the marketing is doing their work on you.
You think in terms of comparisons and competitors and that will always get you. The truth is, I'm glad Apple finally focused on how "something makes you feel" with iOS 7. There is so much truth in that one sentence!
There is so much noise out there about screen size, n core processors and price comparisons you can never get a good feel of what the product really is. By the time you figure out you were taken on a marketing hike, a new model comes out and the story starts all over again. (think of the nokia 40 megapixel camera, or the quad core samsung, those are exagerations to impress the consumer) Imagine the size of the jpg's on that phone, all those megapixels with the quality of a phone camera, ridiculous. Soon we will have 12-core phones with 7 inch screens, and people being led into thinking you can do everything on it, "one thing to rule them all", buy now! I saw a woman on the metro the other day with a 6' phone, I swear the thing was almost half the size of her head.
It's almost 2014 and you are complaining you can't send sms(which is a 25 year old technology by the way) with this new device. All your friends are using outdated tech and because you want to talk to them you want outdated tech too. Sms is insecure, easily snooped upon and recorded, the carrier charges for it and charges more for international sms, and so on... and on... internet chat has been free since the 1990s and it's about time it got free on our phones too.
Just forget about it. Enjoy other people taking the decisions, you can't take yourself, for you. Trust them, see if it fits, care about life, act emotionally when you "feel" like it. You deserve that, you are human, take the feeling home with you, share it with others.
Who cares if it's the 2014 edition or quad core... I gave my old iPad 3 to my grandmother so I could call her on Facetime. I bought the iPad Air on a whim, I just "felt" I wanted it. After a couple of weeks she thought about asking me if she could call my brother in the UK too, and how much it would cost. I said it was free, and she looked at me in disbelief. She is now calling my brother weekly by herself... she is 78. Can you imagine that... all I did is give her my "old" iPad.
Buying the iPad Air was the single best decision of my life, not because of the size or the weight or even iOS 7 (i do enjoy them by the way) but because it made me give my old iPad to my grandmother.
She doesn't even understand how it works, I figured it would be too much useless stuff to mention... it just does! Here put your finger here and here, then tap the name... wait for him to answer. Unbelievable!!!
PS. I figured the best gift I can make is give my old Apple devices to people who would never in a million years buy one for themselves. You see them in shops, they are our mothers and friends... they look at the huge prices and they would never give that much to themselves, they feel they don't deserve it. They gave me money to buy all the useless cr@p I ever wanted in my youth, the least I could do is gift them my "old tech" to enrich their lives. Going to buy a 5S soon and give my 4S to someone for free, but it's going to be someone I care deeply about, deeply enough to change their lives.

Personal Communicator no Presence State

Hi,
I configured a Presence Server with Personal Communicator. The Presence server have a LDAP Connection. I can add users. The problem I have is that I see no Presence state at the communicator. At the communicator at the check everything is green.
Where can I search to solve the problem?
thanks Achim

Check the following:
1) On CUCM > Device > Trunk. Make sure you have a SIP trunk pointing to the IP address of CUPS, port 5060.
2) On CUCM > System > Service Parameters > Cisco CallManager, make sure CUP Publish Trunk was configured as the trunk above.
3) On CUCM > Device > Phone, click on the DN configured on the phone. Go to the bottom of the page. Make sure end user ID was associated with the DN.
If all checked out but still not work, do the following:
1) On CUCM > Device > Trunk, reset the trunk.
2) On CUPS > Serviceability >Tools - Feature Services, restart "Cisco UP Presence Engine"
3) On CUCM > Device > Phone, reset the phone.
Michael
http://htluo.blogspot.com

Report Builder Wizard and Parameter Creation with values from other data source e.g. data set or views for non-IT users or Business Analysts

Hi,
"Report Builder is a report authoring environment for business users who prefer to work in the Microsoft Office environment.
You work with one report at a time. You can modify a published report directly from a report server. You can quickly build a report by adding items from the Report Part Gallery provided by report designers from your organization." - As mentioned
on TechNet.
I wonder how a non-technical business analyst can use Report Builder 3 to create ad-hoc reports/analysis with list of parameters based on other data sets.
Do they need to learn TSQL or how to add and link parameter in Report Builder? then How they can add parameter into a report. Not sure what i am missing from whole idea behind Report builder then?
I have SQL Server 2012 STD and Report Builder 3.0 and want to train non-technical users to create reports as per their need without asking to IT department.
Everything seems simple and working except parameters with list of values e.g. Sales year List, Sales Month List, Gender etc. etc.
So how they can configure parameters based on Other data sets?
Workaround in my mind is to create a report with most of columns and add most frequent parameters based on other data sets and then non-technical user modify that report according to their needs but that way its still restricting users to
a set of defined reports?
I want functionality like "Excel Power view parameters" into report builder which is driven from source data and which is only available Excel 2013 onward which most of people don't have yet.
So how to use Report Builder. Any other thoughts or workaround or guide me the purpose of Report Builder, please let me know.
Many thanks and Kind Regards,
For quick review of new features, try virtual labs: http://msdn.microsoft.com/en-us/aa570323

Hi Asam,
If we want to create a parameter depend on another dataset, we can additional create or add the dataset, embedded or shared, that has a query that contains query variables. Then use the option that “Get values from a
query” to get available values. For more details, please see:http://msdn.microsoft.com/en-us/library/dd283107.aspx
http://msdn.microsoft.com/en-us/library/dd220464.aspx
As to the Report Builder features, we can refer to the following articles:http://technet.microsoft.com/en-us/library/hh213578.aspx
http://technet.microsoft.com/en-us/library/hh965699.aspx
Hope this helps.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

Non admin user - changes not saved (Safari settings, system prefs, etc.)

iMac, 2 users, one is administrator and other is standard user. Recently, in the non-admin user account, it has become impossible to make any changes. For example, adding an application to the the Dock, after logging out and back in next time, the application is not in the Dock any more. Also, making changes to the prefs in Safari, changes are not saved.
I noticed this after installing FireFox v4. I installed it as admin whilst in the non-admin users account. However, I don't believe that the installation of FF has anything to do with the problem, it just highlighted it. I've checked the permissions for the various directories that hold prefs info such as user/libraries/application prefs/etc. etc. and also Safari prefs. Nothing I can see that has changed in system prefs.
Any ideas on what has caused the problem (kids are known to fiddle from within the non-admin account) and any ideas on how to fix it?
Thanks

Hi PPRuNe,
You could try making the standard user an Admin too. To do this, make sure you are logged in to the standard user, go to System Preferences > Accounts > Standard user (you may have to unlock the padlock) > Allow user to administer this computer
This will allow changes to be made without being prompted for a password all the time.
However, if you had Parental Controls on, they probably won't work on an admin account because as an admin you have complete control over a computer, so the computer thinks there is no point in having the controls turned on. And if the kids are known to "fiddle," just think carefully!
Hope this helps you.
Chris.

Access to ZMSS## t-codes in R/3 by non-HR Users

In our production system, a user with no HR access was able to access the following transaction codes:
ZMSS01
ZMSS02
ZMSS03
ZMSS04
ZMSS05
These transactions cannot be accessed from the main SAP Easy Access Menu (in R/3). But if you are in a different transaction code and you type /nZMSS##, then it opens the transaction. For example, a non-HR user from the Finance team was in transaction ZKKS1 (Variances: Manufacturing Orders and Product Cost Collectors) was able to type /nZMSS01 and accessed the HR reports.
These are all t-codes that were built for use on the Enterprise Portal to run reports. When used in R/3, they open the same reports. Since the user does not have any HR authorizations, they were not able to execute the reports to get results, however this is a security concern as a non-HR user has access to HR reporting screens (even though they cannot execute the reports).
Is anyone familiar with how users could be getting this additional access? Also how does a user have access to the transactions ZMSS## from another SAP transaction but not from the SAP Easy Access Menu? Is there a way to restrict access to these report transactions?
Thank you,
Gao

Gao,
Did the developers of the t_codes add authorization objects to the transaction codes and programs? If not they should as that is the security restriction you add to a transaction to limit users.
Go t_code SE93 --> Enter ZMSS01 --> Display and see the authorization object field and maintain the Authorization Object for this t_code.
*Documentation:
Auth. object in user master maintenance
Element of the authorization system.
An authorization object combines up to 10 authorization fields, which are checked using the AND connective.
Authorizations are checked against objects in the system. Authorization objects enable complex checks (linked to several conditions) of an authorization. For the authorization check to be successful, the user must pass the check for each field contained in the object.
Procedure
Enter the name of the authorization object, which is checked against the authorizations of the calling user when a transaction is started. If the user does not have the necessary authorizations, the transaction will be cancelled.
You should normally specify an object, which is also checked within the program.
This check only takes place when calls are made via START TRANSACTION and via the entry "/n<Transaction code>".
The check is not performed for CALL TRANSACTION or for parameter transactions. If a critical transaction is called in this way, it is the responsibility of the caller to perform the necessary check (AUTHORITY-CHECK).

Non root user can delete root files, bug?

We're having an odd permissions based problem on Solaris 10 u5 x86_64, (new install, fully patched as of 2 days ago) It means that non root users can delete root owned files, which is something I've never seen before, and I've been doing this for almost 10 years.
We're installing into an 80Gb container on VMware ESX server 3.0.1. The OS takes 20Gb (2 processors, 4Gb memory, 8Gb swap) most of the remaining 60Gb is being used as both file systems and raw devices under disksuite as soft partitions. It's one of the file systems, /apps (where we plan to install sybase) that is giving us "issues"
Essentially:
# more /etc/vfstab |grep apps
/dev/md/dsk/d0 /dev/md/rdsk/d0 /apps ufs 2 yes -
# newfs -v /dev/md/rdsk/d0
/dev/md/rdsk/d0: Unable to find Media type. Proceeding with system determined parameters.
newfs: /dev/md/rdsk/d0 last mounted as /apps
newfs: construct a new file system /dev/md/rdsk/d0: (y/n)? y
mkfs -F ufs /dev/md/rdsk/d0 20971520 -1 -1 8192 1024 264 1 546 8192 t 0 -1 8 7 n
/dev/md/rdsk/d0: Unable to find Media type. Proceeding with system determined parameters.
Warning: 4096 sector(s) in last cylinder unallocated
/dev/md/rdsk/d0: 20971520 sectors in 3414 cylinders of 48 tracks, 128 sectors
10240.0MB in 214 cyl groups (16 c/g, 48.00MB/g, 5824 i/g)
super-block backups (for fsck -F ufs -o b=#) at:
32, 98464, 196896, 295328, 393760, 492192, 590624, 689056, 787488, 885920,
20055584, 20154016, 20252448, 20350880, 20449312, 20547744, 20646176,
20744608, 20843040, 20941472
# mount /apps
# ls -al /apps
total 20
drwxr-xr-x 3 root root 512 Sep 10 12:31 .
drwxr-xr-x 38 root root 1024 Sep 10 12:09 ..
drwx------ 2 root root 8192 Sep 10 12:31 lost+found
# su - sybase
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
sol10% cd /apps
sol10% rm *
rm: lost+found is a directory
sol10% rm -rf *
rm: cannot read directory lost+found: Permission denied
sol10% ls -al
total 20
drwxr-xr-x 3 root root 512 Sep 10 12:31 .
drwxr-xr-x 38 root root 1024 Sep 10 12:09 ..
drwx------ 2 root root 8192 Sep 10 12:31 lost+found
sol10% exit
sol10% logout
# chgrp sybase /apps
# chmod g+w /apps
# ls -ald /apps
drwxrwxr-x 3 root sybase 512 Sep 10 12:31 /apps
# ls -al /apps
total 20
drwxrwxr-x 3 root sybase 512 Sep 10 12:31 .
drwxr-xr-x 38 root root 1024 Sep 10 12:09 ..
drwx------ 2 root root 8192 Sep 10 12:31 lost+found
# su - sybase
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
sol10% cd /apps
sol10% rm -rf *
sol10% ls -al
total 4
drwxrwxr-x 2 root sybase 512 Sep 10 12:34 .
drwxr-xr-x 38 root root 1024 Sep 10 12:09 ..
sol10% id
uid=***(sybase) gid=***(sybase)
sol10% exit
sol10% logout
# pwd
# ls -ald /apps
drwxrwxr-x 2 root sybase 512 Sep 10 12:34 /apps
# ls -al /apps
total 4
drwxrwxr-x 2 root sybase 512 Sep 10 12:34 .
drwxr-xr-x 38 root root 1024 Sep 10 12:09 ..
It's a new "bare metal" (in as much as there is no metal) install. I created the sybase user from scratch by hand editing passwd, group and shadow, buy copying and pasting the data out of the NIS maps. All I've done besides the install & patch is setup networking manually, and created the metadb's and the soft partitions and the mount points & newfs'ed & mounted three of them . I then changed ownership of /apps to be sybase:sybase, and handed it to the database team for the sybase install. they came back and said "should we be able to do this?" as they habitually run rm rf * knowing they can't delete root owned files, only now they can... This is true even if I just chgrp the directory and give them group write permissions. They can still delete anything owned by root, even if it doesn't have group permissions just like the lost+found directory. No other "real" machine we have, x86 or SPARC does this, but we've never installed u5 before either.
As you can imagine losing the lost+found directory is a bit of a problem, however what's really worrying me is if they can do that, what happens when they run sybase as the sybase user? If it borks can they trash the OS and write/overwrite random files?
It's a VM, so in as much that's not a problem, but the reason it's a VM is somebody wants to send a VM to a client as a demo, and at present it's highly unstable IMO.
Does anyone have any idea where to start? My thoughts are that it may be a VMware issue, (though the hardware and the guest OS is supported) it could be a bug, because I've never seen that weird newfs error before, and then I found this:
http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6622243
Or it could be me, and the fact that I'm hand configuring it, and u5 now requires I do it "properly" with useradd, etc. I'd like to test, but the guy wants it built, and wants it now, so I patched it up, and gave it back to the database team and told them to be careful.
I'd be interested in you opinions regardless.
The full spec of the "machine" is below, sol10 is not it's name for obvious reasons, and I've hashed out the ID & GIUD for similar reasons.
# uname -a
SunOS sol10 5.10 Generic_127128-11 i86pc i386 i86pc
# prtdiag
System Configuration: VMware, Inc. VMware Virtual Platform
BIOS Configuration: Phoenix Technologies LTD 6.00 09/06/2007
==== Processor Sockets ====================================
Version Location Tag
Pentium(R) Pro CPU socket #0
Pentium(R) Pro CPU socket #1
==== Memory Device Sockets ================================
Type Status Set Device Locator Bank Locator
DRAM in use 0 RAM slot #0 RAM slot #0
DRAM in use 0 RAM slot #1 RAM slot #1
DRAM in use 0 RAM slot #2 RAM slot #2
DRAM in use 0 RAM slot #3 RAM slot #3
==== On-Board Devices =====================================
VMware SVGA II
ES1371
==== Upgradeable Slots ====================================
ID Status Type Description
0 unknown ISA ISA Slot J8
0 unknown ISA ISA Slot J9
0 unknown ISA ISA Slot J10
1 in use PCI PCI Slot J11
2 in use PCI PCI Slot J12
3 in use PCI PCI Slot J13
4 available PCI PCI Slot J14
# dmesg
Wednesday, 10 September 2008 15:33:35 BST
Sep 10 10:17:44 sol10 busra: [ID 490441 kern.info] NOTICE: ndi_ra_free: bad free, dip ffffffff803807a8, resource type memory
Sep 10 10:17:44 sol10 busra: [ID 883242 kern.info] NOTICE: ndi_ra_free: freeing base 0xe0000, len 0x4000 overlaps with existing resource base 0x0, len 0xf4000000
Sep 10 10:17:44 sol10 rootnex: [ID 349649 kern.info] pci0 at root: space 0 offset 0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] pci0 is /pci@0,0
Sep 10 10:17:44 sol10 scsi: [ID 365881 kern.info] /pci@0,0/pci1000,30@10 (mpt0):
Sep 10 10:17:44 sol10 Rev. 1 LSI, Inc. 1030 found.
Sep 10 10:17:44 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: pci1000,30 (mpt) instance 0 vector 0x11 ioapic 0x2 intin 0x11 is bound to cpu 0
Sep 10 10:17:44 sol10 scsi: [ID 365881 kern.info] /pci@0,0/pci1000,30@10 (mpt0):
Sep 10 10:17:44 sol10 mpt0 Firmware version v0.0.0.0 (?)
Sep 10 10:17:44 sol10 scsi: [ID 365881 kern.info] /pci@0,0/pci1000,30@10 (mpt0):
Sep 10 10:17:44 sol10 mpt0: IOC Operational.
Sep 10 10:17:44 sol10 pci: [ID 370704 kern.info] PCI-device: pci1000,30@10, mpt0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] mpt0 is /pci@0,0/pci1000,30@10
Sep 10 10:17:44 sol10 scsi: [ID 193665 kern.info] sd0 at mpt0: target 0 lun 0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] sd0 is /pci@0,0/pci1000,30@10/sd@0,0
Sep 10 10:17:44 sol10 genunix: [ID 408114 kern.info] /pci@0,0/pci1000,30@10/sd@0,0 (sd0) online
Sep 10 10:17:44 sol10 unix: [ID 190185 kern.info] SMBIOS v2.31 loaded (1695 bytes)
Sep 10 10:17:44 sol10 genunix: [ID 408114 kern.info] /cpus (cpunex0) online
Sep 10 10:17:44 sol10 pseudo: [ID 129642 kern.info] pseudo-device: dld0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] dld0 is /pseudo/dld@0
Sep 10 10:17:44 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: i8042 (i8042) instance 0 vector 0x1 ioapic 0x2 intin 0x1 is bound to cpu 1
Sep 10 10:17:44 sol10 pcplusmp: [ID 398438 kern.info] pcplusmp: i8042 (i8042) instance #0 vector 0xc ioapic 0x2 intin 0xc is bound to cpu 1
Sep 10 10:17:44 sol10 i8042: [ID 526150 kern.info] 8042 device: keyboard@0, kb8042 # 0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] kb80420 is /isa/i8042@1,60/keyboard@0
Sep 10 10:17:44 sol10 i8042: [ID 526150 kern.info] 8042 device: mouse@1, mouse8042 # 0
Sep 10 10:17:44 sol10 genunix: [ID 936769 kern.info] mouse80420 is /isa/i8042@1,60/mouse@1
Sep 10 10:17:44 sol10 unix: [ID 950921 kern.info] cpu0: x86 (GenuineIntel family 6 model 15 step 8 clock 2000 MHz)
Sep 10 10:17:44 sol10 unix: [ID 950921 kern.info] cpu0: Intel(r) Xeon(r) CPU E5335 @ 2.00GHz
Sep 10 10:17:47 sol10 unix: [ID 950921 kern.info] cpu1: x86 (GenuineIntel family 6 model 15 step 8 clock 2000 MHz)
Sep 10 10:17:47 sol10 unix: [ID 950921 kern.info] cpu1: Intel(r) Xeon(r) CPU E5335 @ 2.00GHz
Sep 10 10:17:47 sol10 unix: [ID 557827 kern.info] cpu1 initialization complete - online
Sep 10 10:17:47 sol10 rootnex: [ID 349649 kern.info] iscsi0 at root
Sep 10 10:17:47 sol10 genunix: [ID 936769 kern.info] iscsi0 is /iscsi
Sep 10 10:17:52 sol10 genunix: [ID 454863 kern.info] dump on /dev/dsk/c1t0d0s1 size 8197 MB
Sep 10 10:17:53 sol10 pci: [ID 370704 kern.info] PCI-device: pci8086,7191@1, pci_pci0
Sep 10 10:17:53 sol10 genunix: [ID 936769 kern.info] pci_pci0 is /pci@0,0/pci8086,7191@1
Sep 10 10:17:54 sol10 mac: [ID 469746 kern.info] NOTICE: e1000g0 registered
Sep 10 10:17:54 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: pci8086,100f (e1000g) instance 0 vector 0x12 ioapic 0x2 intin 0x12 is bound to cpu 0
Sep 10 10:17:54 sol10 e1000g: [ID 766679 kern.info] Intel(R) PRO/1000 Network Connection, Driver Ver. 5.1.11
Sep 10 10:17:54 sol10 pseudo: [ID 129642 kern.info] pseudo-device: zfs0
Sep 10 10:17:54 sol10 genunix: [ID 936769 kern.info] zfs0 is /pseudo/zfs@0
Sep 10 10:17:55 sol10 pseudo: [ID 129642 kern.info] pseudo-device: pm0
Sep 10 10:17:55 sol10 genunix: [ID 936769 kern.info] pm0 is /pseudo/pm@0
Sep 10 10:17:55 sol10 pseudo: [ID 129642 kern.info] pseudo-device: power0
Sep 10 10:17:55 sol10 genunix: [ID 936769 kern.info] power0 is /pseudo/power@0
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: devinfo0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] devinfo0 is /pseudo/devinfo@0
Sep 10 10:17:56 sol10 rootnex: [ID 349649 kern.info] xsvc0 at root
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] xsvc0 is /xsvc
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: pseudo1
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] pseudo1 is /pseudo/zconsnex@1
Sep 10 10:17:56 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: lp (ecpp) instance 0 vector 0x7 ioapic 0x2 intin 0x7 is bound to cpu 1
Sep 10 10:17:56 sol10 isa: [ID 202937 kern.info] ISA-device: ecpp0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] ecpp0 is /isa/lp@1,378
Sep 10 10:17:56 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: asy (asy) instance 0 vector 0x4 ioapic 0x2 intin 0x4 is bound to cpu 0
Sep 10 10:17:56 sol10 isa: [ID 202937 kern.info] ISA-device: asy0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] asy0 is /isa/asy@1,3f8
Sep 10 10:17:56 sol10 pcplusmp: [ID 398438 kern.info] pcplusmp: asy (asy) instance #1 vector 0x3 ioapic 0x2 intin 0x3 is bound to cpu 0
Sep 10 10:17:56 sol10 isa: [ID 202937 kern.info] ISA-device: asy1
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] asy1 is /isa/asy@1,2f8
Sep 10 10:17:56 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: ide (ata) instance 0 vector 0xe ioapic 0x2 intin 0xe is bound to cpu 1
Sep 10 10:17:56 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: ide (ata) instance 0 vector 0xe ioapic 0x2 intin 0xe is bound to cpu 0
Sep 10 10:17:56 sol10 genunix: [ID 640982 kern.info] ATAPI device at targ 0, lun 0 lastlun 0x0
Sep 10 10:17:56 sol10 genunix: [ID 846691 kern.info] model VMware Virtual IDE CDROM Drive
Sep 10 10:17:56 sol10 genunix: [ID 479077 kern.info] ATA/ATAPI-4 supported, majver 0x1e minver 0x17
Sep 10 10:17:56 sol10 pci: [ID 370704 kern.info] PCI-device: ide@0, ata0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] ata0 is /pci@0,0/pci-ide@7,1/ide@0
Sep 10 10:17:56 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:17:56 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:17:56 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:17:56 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:17:56 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:17:56 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:17:56 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:17:56 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:17:56 sol10 scsi: [ID 193665 kern.info] sd1 at ata0: target 0 lun 0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] sd1 is /pci@0,0/pci-ide@7,1/ide@0/sd@0,0
Sep 10 10:17:56 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: fdc (fdc) instance 0 vector 0x6 ioapic 0x2 intin 0x6 is bound to cpu 1
Sep 10 10:17:56 sol10 isa: [ID 202937 kern.info] ISA-device: fdc0
Sep 10 10:17:56 sol10 fdc: [ID 114370 kern.info] fd0 at fdc0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] fd0 is /isa/fdc@1,3f0/fd@0,0
Sep 10 10:17:56 sol10 genunix: [ID 314293 kern.info] device pciclass,030000@f(display#0) keeps up device sd@0,0(sd#1), but the latter is not power managed
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: nvidia255
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] nvidia255 is /pseudo/nvidia@255
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: ramdisk1024
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] ramdisk1024 is /pseudo/ramdisk@1024
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lockstat0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] lockstat0 is /pseudo/lockstat@0
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: llc10
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] llc10 is /pseudo/llc1@0
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lofi0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] lofi0 is /pseudo/lofi@0
Sep 10 10:17:56 sol10 pseudo: [ID 129642 kern.info] pseudo-device: dtrace0
Sep 10 10:17:56 sol10 genunix: [ID 936769 kern.info] dtrace0 is /pseudo/dtrace@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: profile0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] profile0 is /pseudo/profile@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: systrace0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] systrace0 is /pseudo/systrace@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fbt0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] fbt0 is /pseudo/fbt@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: sdt0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] sdt0 is /pseudo/sdt@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fasttrap0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] fasttrap0 is /pseudo/fasttrap@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fcp0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] fcp0 is /pseudo/fcp@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fcsm0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] fcsm0 is /pseudo/fcsm@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lx_systrace0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] lx_systrace0 is /pseudo/lx_systrace@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: ucode0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] ucode0 is /pseudo/ucode@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fssnap0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] fssnap0 is /pseudo/fssnap@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: winlock0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] winlock0 is /pseudo/winlock@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: vol0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] vol0 is /pseudo/vol@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: rsm0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] rsm0 is /pseudo/rsm@0
Sep 10 10:17:57 sol10 pseudo: [ID 129642 kern.info] pseudo-device: pool0
Sep 10 10:17:57 sol10 genunix: [ID 936769 kern.info] pool0 is /pseudo/pool@0
Sep 10 10:17:57 sol10 ipf: [ID 774698 kern.info] IP Filter: v4.1.9, running.
Sep 10 10:18:05 sol10 nfs4cbd[395]: [ID 867284 daemon.notice] nfsv4 cannot determine local hostname binding for transport tcp - delegations will not be available on this transport
Sep 10 10:18:10 sol10 sendmail[598]: [ID 702911 mail.crit] My unqualified host name (localhost) unknown; sleeping for retry
Sep 10 10:18:10 sol10 sendmail[600]: [ID 702911 mail.crit] My unqualified host name (localhost) unknown; sleeping for retry
Sep 10 10:18:17 sol10 mac: [ID 736570 kern.info] NOTICE: e1000g0 unregistered
Sep 10 10:19:10 sol10 sendmail[598]: [ID 702911 mail.alert] unable to qualify my own domain name (localhost) -- using short name
Sep 10 10:19:10 sol10 sendmail[600]: [ID 702911 mail.alert] unable to qualify my own domain name (localhost) -- using short name
Sep 10 10:20:10 sol10 pseudo: [ID 129642 kern.info] pseudo-device: devinfo0
Sep 10 10:20:10 sol10 genunix: [ID 936769 kern.info] devinfo0 is /pseudo/devinfo@0
Sep 10 10:24:54 sol10 mac: [ID 469746 kern.info] NOTICE: e1000g0 registered
Sep 10 10:24:54 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: pci8086,100f (e1000g) instance 0 vector 0x12 ioapic 0x2 intin 0x12 is bound to cpu 0
Sep 10 10:24:54 sol10 e1000g: [ID 766679 kern.info] Intel(R) PRO/1000 Network Connection, Driver Ver. 5.1.11
Sep 10 10:24:59 sol10 e1000g: [ID 801725 kern.info] NOTICE: pci8086,100f - e1000g[0] : Adapter 1000Mbps full duplex copper link is up.
Sep 10 10:28:21 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
Sep 10 10:35:17 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:35:17 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:35:17 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:35:17 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:35:17 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:35:17 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:35:17 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:35:17 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:35:17 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: lp (ecpp) instance 0 vector 0x7 ioapic 0x2 intin 0x7 is bound to cpu 1
Sep 10 10:35:17 sol10 isa: [ID 202937 kern.info] ISA-device: ecpp0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] ecpp0 is /isa/lp@1,378
Sep 10 10:35:17 sol10 pcplusmp: [ID 637496 kern.info] pcplusmp: asy (asy) instance 0 vector 0x4 ioapic 0x2 intin 0x4 is bound to cpu 0
Sep 10 10:35:17 sol10 isa: [ID 202937 kern.info] ISA-device: asy0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] asy0 is /isa/asy@1,3f8
Sep 10 10:35:17 sol10 pcplusmp: [ID 398438 kern.info] pcplusmp: asy (asy) instance #1 vector 0x3 ioapic 0x2 intin 0x3 is bound to cpu 0
Sep 10 10:35:17 sol10 isa: [ID 202937 kern.info] ISA-device: asy1
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] asy1 is /isa/asy@1,2f8
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: nvidia255
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] nvidia255 is /pseudo/nvidia@255
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: ramdisk1024
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] ramdisk1024 is /pseudo/ramdisk@1024
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lockstat0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] lockstat0 is /pseudo/lockstat@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: llc10
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] llc10 is /pseudo/llc1@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lofi0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] lofi0 is /pseudo/lofi@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: profile0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] profile0 is /pseudo/profile@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: systrace0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] systrace0 is /pseudo/systrace@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fbt0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] fbt0 is /pseudo/fbt@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: sdt0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] sdt0 is /pseudo/sdt@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fcp0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] fcp0 is /pseudo/fcp@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fcsm0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] fcsm0 is /pseudo/fcsm@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: lx_systrace0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] lx_systrace0 is /pseudo/lx_systrace@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: ucode0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] ucode0 is /pseudo/ucode@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: fssnap0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] fssnap0 is /pseudo/fssnap@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: winlock0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] winlock0 is /pseudo/winlock@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: pm0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] pm0 is /pseudo/pm@0
Sep 10 10:35:17 sol10 pseudo: [ID 129642 kern.info] pseudo-device: rsm0
Sep 10 10:35:17 sol10 genunix: [ID 936769 kern.info] rsm0 is /pseudo/rsm@0
Sep 10 10:55:50 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:55:50 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:55:50 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:55:50 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:55:50 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:55:50 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 10:55:50 sol10 genunix: [ID 935449 kern.info] ATA DMA off: disabled. Control with "atapi-cd-dma-enabled" property
Sep 10 10:55:50 sol10 genunix: [ID 882269 kern.info] PIO mode 4 selected
Sep 10 11:28:55 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
Sep 10 12:28:56 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
Sep 10 13:29:01 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
Sep 10 14:29:10 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
Sep 10 15:29:38 sol10 in.routed[502]: [ID 798604 daemon.error] empty response from 129.0.1.124
# prtconf
System Configuration: Sun Microsystems i86pc
Memory size: 4132 Megabytes
System Peripherals (Software Nodes):
i86pc
scsi_vhci, instance #0
isa, instance #0
i8042, instance #0
keyboard, instance #0
mouse, instance #0
lp, instance #0
asy, instance #0
asy, instance #1
fdc, instance #0
fd, instance #0
pci, instance #0
pci15ad,1976 (driver not attached)
pci8086,7191, instance #0
pci15ad,1976 (driver not attached)
pci-ide, instance #0
ide, instance #0
sd, instance #1
ide (driver not attached)
pci15ad,1976 (driver not attached)
display, instance #0
pci1000,30, instance #0
sd, instance #0
pci15ad,750, instance #0
iscsi, instance #0
pseudo, instance #0
options, instance #0
agpgart, instance #0
xsvc, instance #0
objmgr, instance #0
acpi (driver not attached)
used-resources (driver not attached)
cpus, instance #0
cpu (driver not attached)
cpu (driver not attached)
# format
Searching for disks...done
AVAILABLE DISK SELECTIONS:
0. c1t0d0 <DEFAULT cyl 10440 alt 2 hd 255 sec 63>
/pci@0,0/pci1000,30@10/sd@0,0
Specify disk (enter its number): 0
selecting c1t0d0
[disk formatted]
Warning: Current Disk has mounted partitions.
/dev/dsk/c1t0d0s0 is currently mounted on /. Please see umount(1M).
/dev/dsk/c1t0d0s1 is currently used by swap. Please see swap(1M).
/dev/dsk/c1t0d0s3 is currently mounted on /usr. Please see umount(1M).
/dev/dsk/c1t0d0s4 is currently mounted on /var. Please see umount(1M).
/dev/dsk/c1t0d0s5 is currently mounted on /opt. Please see umount(1M).
/dev/dsk/c1t0d0s6 is part of SVM volume sp:d8. Please see metaclear(1M).
/dev/dsk/c1t0d0s7 contains an SVM mdb. Please see metadb(1M).
FORMAT MENU:
disk - select a disk
type - select (define) a disk type
partition - select (define) a partition table
current - describe the current disk
format - format and analyze the disk
fdisk - run the fdisk program
repair - repair a defective sector
label - write label to the disk
analyze - surface analysis
defect - defect list management
backup - search for backup labels
verify - read and display labels
save - save new disk/partition definitions
inquiry - show vendor, product and revision
volname - set 8-character volume name
!<cmd> - execute <cmd>, then return
quit
format> p
PARTITION MENU:
0 - change `0' partition
1 - change `1' partition
2 - change `2' partition
3 - change `3' partition
4 - change `4' partition
5 - change `5' partition
6 - change `6' partition
7 - change `7' partition
select - select a predefined table
modify - modify a predefined partition table
name - name the current table
print - display the current table
label - write partition map and label to the disk
!<cmd> - execute <cmd>, then return
quit
partition> p
Current partition table (original):
Total disk cylinders available: 10440 + 2 (reserved cylinders)
Part Tag Flag Cylinders Size Blocks
0 root wm 1 - 131 1.00GB (131/0/0) 2104515
1 swap wu 132 - 1176 8.01GB (1045/0/0) 16787925
2 backup wm 0 - 10439 79.97GB (10440/0/0) 167718600
3 usr wm 1177 - 1829 5.00GB (653/0/0) 10490445
4 var wm 1830 - 2091 2.01GB (262/0/0) 4209030
5 unassigned wm 2092 - 2614 4.01GB (523/0/0) 8401995
6 unassigned wm 2617 - 10439 59.93GB (7823/0/0) 125676495
7 unassigned wm 2615 - 2616 15.69MB (2/0/0) 32130
8 boot wu 0 - 0 7.84MB (1/0/0) 16065
9 unassigned wm 0 0 (0/0/0) 0
partition> quit
FORMAT MENU:
disk - select a disk
type - select (define) a disk type
partition - select (define) a partition table
current - describe the current disk
format - format and analyze the disk
fdisk - run the fdisk program
repair - repair a defective sector
label - write label to the disk
analyze - surface analysis
defect - defect list management
backup - search for backup labels
verify - read and display labels
save - save new disk/partition definitions
inquiry - show vendor, product and revision
volname - set 8-character volume name
!<cmd> - execute <cmd>, then return
quit
format> q
# metastat -p
d8 -p c1t0d0s6 -o 109973513 -b 61440
d7 -p c1t0d0s6 -o 109461512 -b 512000
d6 -p c1t0d0s6 -o 109051911 -b 409600
d5 -p c1t0d0s6 -o 88080390 -b 20971520
d4 -p c1t0d0s6 -o 67108869 -b 20971520
d3 -p c1t0d0s6 -o 46137348 -b 20971520
d2 -p c1t0d0s6 -o 41943043 -b 4194304
d1 -p c1t0d0s6 -o 20971522 -b 20971520
d0 -p c1t0d0s6 -o 1 -b 20971520

An easy way to think of it is this -- everything in Unix is a file. Including directories; they are just a file which contains a list of the files in that directory, and pointers to them.
If the 'sybase' user has write permission on the directory, they have permission to edit that "list", and can add or remove files to the list. It doesn't matter who the files on the list belong to, because the files are not what is being modified. Only the list of files is being modified. (Of course, in Unix, if you erase the file's listing from all of the lists it's on, the file itself goes away for housekeeping purposes.)
One thing that would have stopped the 'sybase' user from removing the lost+found directory is if that directory itself had files in it -- without write permission to the lost+found directory, that user could not have removed those files, and since one cannot remove a non-empty directory, that operation would have failed. Since lost+found was empty in this case, it could be removed simply by having permission to write to the /apps directory.
This behavior does change if you set the sticky bit on the directory -- in that case, files may only be removed by the owner of the file or directory, or if the user has write permission to the file. This would have prevented the sybase user from removing the lost+found directory. (Note, this also applies to the 'rename' function call.) This would probably be the best way to handle your situation, since you apparently do want the sybase user to be able to add files to /apps, but do not want them to be able to remove lost+found.
Edited by: MadBishop on Sep 12, 2008 7:46 AM

See presence state of non-jabber user

Similar Messages

Maybe you are looking for