From checkmk-werks-lvl1@lists.checkmk.com Thu Apr 18 12:58:10 2024
From: Checkmk werks level 1 <checkmk-werks-lvl1@lists.checkmk.com>
To: checkmk-werks-lvl1@lists.checkmk.com
Subject: [2.1.0] Checkmk Werk 15328 created: mk_oracle: Follow-up to privilege
 escalation fix: sqlnet.ora
Date: Thu, 18 Apr 2024 12:58:08 +0000
Message-ID: <1713445088.948528.1054.nullmailer@localhost>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4436915838948735009=="

--===============4436915838948735009==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Title: mk_oracle: Follow-up to privilege escalation fix: sqlnet.ora
Class: fix
Compatible: incomp
Component: checks
Date: 1712309908
Edition: cre
Level: 1
Version: 2.1.0p42

You are affected by this Werk if you use mk_oracle agent plugin on unix.

<tt>mk_oracle</tt> only works if it can find a <tt>sqlnet.ora</tt> in your
<tt>$TNS_ADMIN</tt> folder. In the past, <tt>mk_oracle</tt> executed all orac=
le
binaries as root, so <tt>sqlnet.ora</tt> was alwas readable. With <a
href=3D"https://checkmk.com/werk/16232">Werk #16232</a> the oracle binaries a=
re
executed with a low privileged user, so it might be the case, that
<tt>sqlnet.ora</tt> can not be read by this user.

<tt>mk_oracle</tt> will exit early if it can not read <tt>sqlnet.ora</tt>. The
error message might look like:

<code>
/etc/check_mk/sqlnet.ora can not be read by user "oracle"! Either use 'sqlnet=
.ora permission group' bakery rule, or directly modify permissions of the fil=
e.
</code>

The error message will also be visible in the <tt>oracle_instance</tt> check.

If you use the agent bakery to roll out mk_oracle to unix servers using
<tt>.rpm</tt>, <tt>.deb</tt> or Solaris <tt>.pkg</tt> packages, you have to u=
se
the 'sqlnet.ora permission group' bakery rule to adapt the group of the
<tt>sqlnet.ora</tt> file, otherwise your permission changes might be
overwritten by updating the agent.

Otherwise it is sufficient to adapt the permissions.

If you install the agent on Unix using the <tt>tgz</tt> package, you will have
to manually adjust the permissions of the <tt>sqlnet.ora</tt> file.



--===============4436915838948735009==--