OPMN Fails to Start Oracle HTTP Server 10g After Changing ‘apachectl’ to Root Ownership and 6750 Permissions

APPLIES TO:
Oracle Fusion Middleware - Version 9.0.4.0.0 to 10.1.4.3.0 [Release AS10g to AS10gR3]
Oracle HTTP Server - Version 9.0.4.0.1 to 10.1.3.5.0 [Release AS10g to AS10gR3]
Information in this document applies to any platform.
Except the MS Windows platform.

SYMPTOMS:
Oracle HTTP Server, residing on a Unix platform, fails to start using OPMN. For example, OPMN reports the generic error

11/09/20-22:55:20 :: adapcctl.sh version 120.7.12010000.2
11/09/20-22:55:20 :: adapcctl.sh: starting OPMN if it is not running

opmnctl: opmn is already running.

11/09/20-22:55:20 :: adapcctl.sh: starting OPMN managed OHS instance

opmnctl: starting opmn managed processes...
================================================================================
opmn id=ebsr1213.doyensys.com:6220
0 of 1 processes started.

ias-instance id=UAT_ebsr1213.ebsr1213.doyensys.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
--------------------------------------------------------------------------------
ias-component/process-type/process-set:
HTTP_Server/HTTP_Server/HTTP_Server/

Error
--> Process (index=1,uid=2050903386,pid=11623)
failed to start a managed process after the maximum retry limit
Log:
/u01/app/oracle/inst/apps/UAT_ebsr1213/logs/ora/10.1.3/opmn/HTTP_Server~1.log

11/09/20-22:55:24 :: adapcctl.sh: exiting with status 0
================================================================================

The HTTP_Server~1 OPMN log file just reports that the HTTP Server has been started, but there are actually no httpd processes present on the system.
There is also nothing written to the $ORACLE_HOME/apache/apache/logs directory even when HTTP Server logLevel is set to debug.
Furthermore there are no core / segmentation fault files created.

CHANGES:
In order for the HTTP Server to listen on ports < 1024 e.g 80 and 443 the ownership and permissions of the Oracle HTTP Server binary - '.apachectl' - have been changed as follows:

chown root .apachectl
chmod 6750 .apachectl
If the ownership and permissions of this binary are reverted back to the default settings HTTP Server starts up fine using OPMN.

CAUSE:
The problem is caused by an underlying problem with the suid functionality at the unix / operating system level. For example to prove whether or not this is the cause, try this simple test.
Logged in as oracle create a simple shell script file and run it as follows:

cd /tmp
vi hello
echo hello
chmod 750 hello
./hello
Now switch to root

su root
[Enter root password]
chown root hello
chmod 6750 hello
[Log out as root so you are back as oracle user]
./hello
If you now see a permissions denied error the suid bit is not working. This is the underlying problem to which OPMN is falling victim when it attempts to execute '.apachectl start' behind the scenes.

SOLUTION:
The underlying cause needs to be addressed by the Unix administrator or vendor. It could be, for example, that the disk hosting the Oracle HTTP Server has been mounted with the nosuid setting. See issue discussed in referenced note below.

One possible work-around is to change .apachectl to belong to another group - such as the generic one users (rather than have the file belong to the oracle group - typically called 'oinstall') e.g

chown root:users .apachectl
chmod 6750 .apachectl
Recent Posts