CHECKING SOLARIS PROJECT KERNEL PARAMETERS

TO CHECK THE CURRENT USER ID AND THE ASSIGNED PROJECT ID  

# id -p

uid=0(root) gid=0(root) projid=1(user.root)

TO CHECK THE RESOURCE CONTROL VALUE OF A PROJECT

Example for Project user.root:

# prctl -n project.max-shm-memory -i project user.root

project: 1: user.root

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

project.max-shm-memory

        privileged       249MB      -   deny                                 -

        system          16.0EB    max   deny                                 -

       

# prctl -n project.max-sem-ids -i project user.root

project: 1: user.root

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

project.max-sem-ids

        privileged        128       -   deny                                 -

        system          16.8M     max   deny                                 -

Example for current user:

# prctl -n process.max-sem-nsems $$   

process: 633: -sh

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

process.max-sem-nsems

        privileged        512       -   deny                                 -

        system          32.8K     max   deny                                 -

        

SETTING SOLARIS PROJECT KERNEL PARAMETERS

TO TEMPORARILY ASSIGN A RESOURCE CONTROL VALUE TO A PROJECT

               

An example to temporarily set 2 GB max shared memory:

# prctl -n project.max-shm-memory -v 2gb -r -i project user.root

# prctl -n project.max-shm-memory -i project user.root

project: 1: user.root

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

project.max-shm-memory

        privileged      2.00GB      -   deny                                 -

        system          16.0EB    max   deny                                 -

 

An Example to temporarily set a process parameter of current session:

1. get the process id

UNIX> who -mHT

NAME       LINE         TIME          IDLE    PID  COMMENTS

orasu    + pts/1        Apr 29 10:27   .     9334       (57.23.211.129)

2. list existing value of process param of current session

UNIX> prctl -n process.max-sem-nsems $$

process: 9334: -ksh

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

process.max-sem-nsems

        privileged      6.14K       -   deny                                 -

        system          32.8K     max   deny                                 -

   

3. Temporary set a new value of process param

As root,

# prctl -n process.max-sem-nsems -v 8192 -r -i process 9334

             

4. Verify new settings

UNIX> prctl -n process.max-sem-nsems 9334

process: 9334: /usr/local/sbin/sshd -R

NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT

process.max-sem-nsems

        privileged      8.19K       -   deny                                 -

        system          32.8K     max   deny                                 -

        

       

        

TO PERMANENTLY ASSIGN A RESOURCE CONTROL VALUE TO A PROJECT

NOTE: The following is an example of a step-by-step in creating groups, projects and users with assigned projects based on the requirements of an Oracle database install.

        

Using SYSTEM MANAGEMENT CONSOLE tool, To permanently set any resource control:

UNIX> /usr/sadm/bin/smc &        

From the system management console,

1) create group:

     orainst, oradba, oraoper, sunweb

     default primary project: group.staff

     

2) create user:

     oradb    (primary grp: orainst)

     sunweb   (primary grp: webadmin)

     

3) create project:

     user.oracle

      * at resource control tab, add shared memory settings for oracle:

            project.max-shm-memory, threshold=4294967295, Modifiable by = Privileged, no signal, action = deny

            process.max-sem-nsems, threshold=2048, Modifiable by = Privileged, no signal, action = deny

     user.sunweb       

4) Assign users to project:

     oradb -> user.oracle

     sunweb -> user.sunweb

          

OR, Using COMMAND LINE To Permanently Set Resource Control:

 

NOTE: The following is an example of a step-by-step in creating groups, projects and users with assigned projects based on the requirements of an Oracle database install.

Kernel parameters now have to be modified via the project file. To set the kernel parameters for Oracle 10g Database:

first as root edit /etc/system and add the following:

  set noexec_user_stack=1

(the settings above requires reboot)

NOTE: Metalink Note 395334.1 explains Why do we need to set

      NOEXEC_USER_STACK to 1 before Oracle installation as a mandatory step:

      Sometimes programs allocate buffers but do not always check the size of

      the data coming into these buffers. An unwanted program can overflow such

      a buffer by placing a pointer to its own code and take control of the

      application with the privileges assigned to that application. Solaris 9

      introduced the option to disable execution of user programs on the stack

      and assist in preventing this type of issue. This feature is only

      available on SPARC and AMD64 systems because it requires hardware support

      that is not available in current Intel 32bit CPUs. The protection is

      setup by employing the system wide parameter 'set noexec_user_stack=1'

      in the /etc/system file.

then, also as root, execute the following:

1) Create the required groups.

     groupadd -g 1001 orainst

     groupadd -g 1002 oradba

     groupadd -g 1003 oraoper

2) Create a project with kernel parameter settings.

At minimum, the database requires to have the following resources set:

max-shm-memory = 4gb

max-file-descriptor = 4096

max-sem-nsems = 1024

The settings of the file descriptors must not exceed the hard limit. You can check the the hard and soft limits through the following commands:

UNIX> ulimit -H -n

UNIX> ulimit -S -n

In projects, use the priv parameter to set the hard limit and basic to set the soft limit for your max-file-descriptor.

   projadd -p 200 -c "Oracle Database Project" \

        -K "project.max-shm-memory=(priv,4294967296,deny)" \

        -K "process.max-sem-nsems=(priv,1024,deny)" \

        -K "process.max-file-descriptor=(basic,4096,deny)"  oracledb

   where:

       -p   assigned project id (is optional)

       -U   list of member users

       -G   list of member group

       -c   comment

       -K   key values

        

   verify changes added in /etc/project

       

   To modify existing project use projmod.

       

       projmod -s -K "project.max-shm-memory=(priv,4gb,deny)" \

               -K "process.max-sem-nsems=(priv,2000,deny)" \

               -K "process.max-file-descriptor=(basic,4096,deny)" oracledb

   

3) Create user - oradb - with assigned project

   useradd -g orainst -G oradba,oraoper -p oracledb -K "project=oracledb" -m \

     -s /bin/ksh -d /export/home/oradb -c "Oracle Database Owner" -u 1001 oradb

   passwd oradb

   

   verify user attributes related to project assignment in /etc/user_attr

   

4) Check All Kernel Resource Settings Of A Current Session

 

4.1) Verify the user's shell settings

   switch to oracle user:

   

     su - oradb

     

   check if oracle user project is not the default:

   

     should be,

     

     UNIX> id -p  

     uid=102(oradb) gid=101(orainst) projid=100(oracle)

     

     and not,

     

     UNIX> id -p  

     uid=102(oradb) gid=101(orainst) projid=3(default)

     

   get taskid of current shell of oracle user:

     

     UNIX> ps -o taskid -p $$

     TASKID

     57

   display resource settings of a task

     

     UNIX> prctl -i task 57

     

4.2) Verify the project default settings   

     Note: There has to be at least one process running that uses

        the project otherwise you get error:

        "prctl: oracle: No controllable process found in task, project, or zone."

        Basic remedy is to open a shell by oracle user.

   

     UNIX> prctl -i project oracle

TO CHECK A LIST OF RUNNING PROCESSES AND THEIR ASSIGNED PROJECTS

     

    UNIX> prstat -J     

   

TO SWITCH THE USER PRIMARY PROJECT TO ANOTHER PROJECT

1. login as the user

2. set a new project for the current log

    newtask -p oracledb -c $$