[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[LDM #MDC-227212]: LDM Compile Error

Hi,

re:
> I was able to get LDM compiled but when performing an ldmadmin start the
> following was in "var/logs/ldmd.log".  why is it asking about setting user-ID 
> to root?
> 
> [ldm@emvrw07v05a0m01 logs]$ more ldmd.log
> 20201022T164900.658345Z ldmd[19676]                 ldmd.c:main:988 NOTE  
> Starting Up (version: 6.13.12; built: Oct 22 2020 16:24:29)
> 20201022T164900.658605Z ldmd[19676]                 priv.c:rootpriv:44 ERROR 
> Operation not permitted
> 20201022T164900.658644Z ldmd[19676]                 priv.c:rootpriv:44 ERROR 
> Couldn't set effective user-ID to root's (0)
> 20201022T164900.658700Z ldmd[19676]                 
> ldmd.c:create_ldm_tcp_svc:48 4       ERROR Permission denied
> 20201022T164900.658731Z ldmd[19676]                 
> ldmd.c:create_ldm_tcp_svc:48 4       ERROR Couldn't obtain local address 
> 0.0.0.0:388 for server
> 20201022T164900.658783Z ldmd[19676]                 ldmd.c:cleanup:197 NOTE  
> Exiting
> 20201022T164900.658880Z ldmd[19676]                 ldmd.c:cleanup:256 NOTE  
> Terminating process group

On startup, the LDM needs to grab port 388, and an application
needs to either be run as 'root' (do NOT do this with the LDM),
or have 'setuid root' privilege to get the port.  The approach
taken in the LDM is to give the needed LDM applications (ldmd and
hupsyslog) 'setuid root' privilege so that it can get port 388
on startup.  The log output you include above strongly suggests
that your LDM has not been built correctly/fully built as the
lead LDM server, ldmd, is not able to grab the port.

The LDM build procedure is basically as follows:

- create an 'ldm' account

  The LDM will be installed in the 'ldm' account.  It should NOT
  be installed in the 'root' account!

- download, unpack, configure and build the latest version of the
  LDM in the 'ldm' account

  One step in the configure and build processes needs to run with
  'root' privilege.  This is accomplished in one of two ways:

  - the user building and installing the LDM knows the 'root' password
    or the 'ldm' account has 'sudo su -' privilege

    The 'root' password (or the 'ldm' password for 'sudo' privilege will
    be asked for during the 'configure' and 'make install' steps.

  OR

  - the user building the LDM specifies the '--disable-root-actions' on
    the 'configure' command line

    This will keep the 'configure' and 'make install' steps from ask
    for the 'root' password (or 'ldm' password for 'sudo').  It then
    also requires that 'root' finish the build so that 'ldmd' and
    'hupsyslog' have 'setuid root' privilege:

    <as 'ldm'>
    -- unpack the LDM distributrion and then
    cd ~ldm/ldm-6.13.12/src
    ./configure --disable-root-actions
    make install

    <as 'root'>
    cd ~ldm/ldm-6.13.12/src
    make root-actions

The symptoms you have described through the log messages you sent
suggest that the '--disable-root-actions' flag was specified on
the 'configurre' invocation command line, but the finishing step
done by 'root' was not taken.  To test to see if this is true,
please send the output of:

<as 'ldm'>
cd ~ldm
ls -alt
ls -alt bin/

Cheers,

Tom
--
****************************************************************************
Unidata User Support                                    UCAR Unidata Program
(303) 497-8642                                                 P.O. Box 3000
address@hidden                                   Boulder, CO 80307
----------------------------------------------------------------------------
Unidata HomePage                       http://www.unidata.ucar.edu
****************************************************************************


Ticket Details
===================
Ticket ID: MDC-227212
Department: Support LDM
Priority: Normal
Status: Open
===================
NOTE: All email exchanges with Unidata User Support are recorded in the Unidata 
inquiry tracking system and then made publicly available through the web.  If 
you do not want to have your interactions made available in this way, you must 
let us know in each email you send to us.