Friday, October 5, 2012

CRS-2566: User 'oracle' does not have sufficient permissions to operate on resource

The following error came up while creating an 4 node rac database on Oracle Unbreakle Linux.
CRS-2566: User 'oracle' does not have sufficient permissions to operate on resource

Exactly there was another error right before the CRS-2566 and that was
ERROR: failed to update diskgroup resource ora.DGTXXX.dg
Strange because i've created the diskgroup without error and its mounted.
I checked if the resource realy didn't exsist.

$ crsctl stat res -t |grep ora.DGTXXX.dg
Noting found. and then comes the second error and the cause of the problem

$ crsctl status resource xxx.test1-admin-vip -p
NAME=eco.paer1-admin-vip
TYPE=app.appvip_net1.type
ACL=owner:root:rwx,pgrp:root:r-x,other::r--,user:root:r-x
ACTION_FAILURE_TEMPLATE=
ACTION_SCRIPT=
ACTIVE_PLACEMENT=1
AGENT_FILENAME=%CRS_HOME%/bin/orarootagent%CRS_EXE_SUFFIX%
APPSVIP_FAILBACK=0
AUTO_START=restore
CARDINALITY=1
CHECK_INTERVAL=1
CHECK_TIMEOUT=30
DEFAULT_TEMPLATE=PROPERTY(RESOURCE_CLASS=vip)
DEGREE=1
DESCRIPTION=Application VIP
ENABLED=1
FAILOVER_DELAY=0
FAILURE_INTERVAL=0
FAILURE_THRESHOLD=0
GEN_USR_ORA_STATIC_VIP=
GEN_USR_ORA_VIP=
HOSTING_MEMBERS=GFM0001.test.nl
LOAD=1
LOGGING_LEVEL=1
NLS_LANG=
NOT_RESTARTING_TEMPLATE=
OFFLINE_CHECK_INTERVAL=0
PLACEMENT=balanced
PROFILE_CHANGE_TEMPLATE=
RESTART_ATTEMPTS=0
SCRIPT_TIMEOUT=60
SERVER_POOLS=*
START_DEPENDENCIES=hard(ora.net1.network) pullup(ora.net1.network)
START_TIMEOUT=0
STATE_CHANGE_TEMPLATE=
STOP_DEPENDENCIES=hard(ora.net1.network)
STOP_TIMEOUT=0
TYPE_VERSION=2.1
UPTIME_THRESHOLD=7d
USR_ORA_ENV=
USR_ORA_VIP=10.001.0001.10
VERSION=11.2.0.2.0

You must as the user who runs the scripts in our case oracle
have read and executer rights on the vips. If not then it can't
create the resource for the diskgroup

As you see in red that the acl(access control list) is there only for root.
The user oracle has no rights on this vip.
So we must grant oracle read and execute rights as on the group oradba.
this is how is looks before
$ crsctl getperm resource xxx.test1-admin-vip
Name: xxx.test1-admin-vip
owner:root:rwx,pgrp:root:r-x,other::r--,user:root:r-x

Now we grant read an executer rights to user oracle and group oradba
As user root(In my enviroment at least)

crsctl setperm resource xxx.test1-admin-vip -u user:oracle:r-x
crsctl setperm resource xxx.test1-admin-vip -g group:oradba:r-x

and then again run
$ crsctl getperm resource xxx.test1-admin-vip
 Name: xxx.test1-admin-vip
owner:root:rwx,pgrp:root:r-x,other::r--,user:root:r-x,user:oracle:r-x,group:oradba:r-x

After that i restarted the creation of the rac database and it when fine.

No comments:

Post a Comment