New capability of tracking features in Storage Foundation creates files with world read/write permission in /var/vx/vftrk/ directory

book

Article ID: 100004142

calendar_today

Updated On:

Description

Error Message

New feature is NOT documented

Cause

Introduction of feature tracking which has the following benefits:
• It provides information useful for filtering patches for applicability to a specific customer environment.
• It provides tracking of features for supportability reasons.
• It allows feature usage to be tracked for license auditing purposes.

Although feature tracking files do not provide troubleshooting details, they could be useful in identifying if a feature was ever used and when it was last used. Note that the feature tracking files are only created when the feature is used.

Resolution

The list of features that are currently being tracked are as follows ( this list may vary slightly)

• VxVM Features: CDS-VXVM, DGSJ, Dynamic LUN Expansion, FMR, FMROLD, PGR, Campus Cluster, VVR, Array Snapshot, CVM, Root Encap, BASIC Overflow, SHAREDDG, PRIVATEDG, CDSDG, VSET

• VxFS Features: ODM Local, ODM Cluster, ODM Cluster Exclusive, QLOG,Checkpoints, Cluster File System, File Change Log, Cross-platform Data Sharing, Extra-Big File Systems, Multi-Volume Support, Dynamic Storage
Tiering, Forced Unmount, Resize FS, Reorg directories, Reorg extents, Quota, Dmapi, VXFDD Cache, Snapshots, VXFDD, Database Editions, Multiple Device, Allocation Policy, Volume Modification,

• VCS features: Global Cluster Option

• DBED features: Database DBDST, Database checkpoint, Database Flashsnap

As a result of tracking this feature files with 666 permission are created in directory /var/vx/vftrk/ of name vxvm , vxfs , vcs and dbed. Example

# ls -l /var/vx/vftrk/vxfs
-rw-rw-rw-   1 root     root       20944 Sep 12 13:03 /var/vx/vftrk/vxfs

Displaying feature tracking information
The /var/vx/vftrk/* files are not easily decipherable without a tool. The /opt/VRTS/bin/vxftrk command which is part of the VRTSvlic package prints out the information in the feature tracking files. Example

#/opt/VRTS/bin/vxftrk
PRODUCT: VxFS FEATURE: VXFDD LAST_MONTH: 26 LAST_YEAR 88 LAST_USED: Thu Sep 15 0
7:26:16 2011 EXTRA: 0 0 0
PRODUCT: VxFS FEATURE: Cluster File System LAST_MONTH: 11 LAST_YEAR 71 LAST_USED
: Thu Sep 15 07:26:16 2011 EXTRA: 0 0 0
 
The "vftrk" functionality  involves ODM and Oracle users and a hence the permissions where set for world read/write by design.
 
Workaround:

To avoid the security issue remove world read/write permissions from the directories.

# chmod 660 /var/vx/vftrk/vxfs
# ls -lrt /var/vx/vftrk/vxfs
-rw-rw----   1 root     root       20936 Sep 16 15:40 /var/vx/vftrk/vxfs

Do not delete the /var/vx/vftrk/vxfs or vxvm or vcs or dbed file once they are created, the tracking software will recreate them with  -rw-rw-rw-  permission. But if they exist with -rw-rw--- it will not update the permission

Note: With  ODM /Oracle  users it may fail to update the tracking information but overall it will not effect the normal day to day operation just the tracking of features.

 

 

Issue/Introduction

Security issue when scanning for world "read/write" files on a secure system .

Additional Information

ETrack: 2063987