Mapped user surrogates in the allowed.surrogates file (UNIX, Linux)

The OS Administrator can use the /etc/onedb/allowed.surrogates file to control which OS users and groups can act as surrogates for mapped users.

The database server uses surrogate user properties while it performs operating system operations on behalf of a mapped user. OS user names, user IDs, group names, and group IDs specified in /etc/onedb/allowed.surrogates file are cached in shared memory during server start-up and after you run onmode -cache surrogates, and are checked during user creation and before the user is allowed to connect to the server.

The onmode -cache surrogates command causes the server to reread the allowed.surrogates file and store the user names, user IDs, group names, and group IDs values in shared memory cache. If the cache-refresh fails, previously stored surrogate names are cleared from the cache, effectively disabling mapped users. Changes in shared memory cache affect new sessions. Existing connections on the server are unaffected.

The improved control makes root installations of HCL OneDB™ more secure by preventing the DBSA from specifying surrogates that could compromise operating system security.

Note: The allowed.surrogates file is not used or read by non-root installations of HCL OneDB, because the database server does not perform operations or run commands as the user who started the session.