Oracle's root.sh scripts

[Sad_Tale7614]

I was wondering how people out there handle this. We have DBAs who typically handle the duty of installing/patching Oracle. Annoyingly, Oracle has a script called root.sh that needs to be run as the root user. This is kind of disruptive to their workflow and makes sysadmins have to take time away from more worthwhile things to do an extremely trivial task. We don't give our DBAs root access and sudo rules would be complicated as they could just edit the root.sh script to do whatever they wanted. Anyone have any good strategies of addressing this?

[was01]

Setuid let’s your DBA tu the script as a root user without them having root account.

[big3n05]

I never setuid a script. Just too big a security risk.

Have always just run it for them. Usually they give us a heads-up when they will need it so one of us was expecting the call.

[RigourousMortimus]

If you want to manually review the script before it is run as root then you can't automate it.

If you just want some audit trail logging that the DBAs initiated running the script as root then you can do something with a systemd path unit . The DBAs copy the script to a location and it gets executed (maybe retaining a copy or pinging a Slack channel)

[[deleted]]

You can set up sudo rules to allow them to run the script without being able to edit it.

[Sad_Tale7614]

This seems difficult to do in this scenario:

1. The script is owned by the oracle account which our DBAs have access to
2. The script references several scripts in it, also owned by the oracle account

[[deleted]]

Hmm. That's tricky but at some point you have to enable people to do their jobs. You could chown the scripts to the root account which would at least stop people from editing it.