su: permission denied despite being root in oracle container

user_5060325 0
Viewed 3442

Running an oracle container based on the official dockerfile. Container is running on an EC2 instance (Amazon Linux 2) which is RHEL derivative, I am getting:

Configuring Oracle Listener.
su: cannot open session: Permission denied
Listener configuration failed. Check log '/opt/oracle/cfgtoollogs/netca/netca_configure_out.log' for more details.
su: cannot open session: Permission denied

Container is started with:

docker run --name=oracledb -p 1521:1521  \
-e ORACLE_SID=XE -e ORACLE_PDB=foo -e ORACLE_PWD=bar \
oracle/database:18.4.0-x

By changing the entrypoint and dropping into the shell as a root, and executing su oracle indeed gives me permission denied. Why is this happening?

docker amazon-web-services amazon-ec2 oracle
2 Answers

I was playing with docker and oraclelinux:7-slim, to install an Oracle Database. After installing oracle-database-preinstall-19c package, I stopped being able to "su -" into oracle account. Many say its because of "nofile unlimited" in limits.conf, others say to comment "session include system-auth" line in /etc/pam.d/su (the last one works by the way). However, before I installed the package, the configuration was all the same and I was able to do "su - oracle". And even if I create a new user belonging to the same group "su -" works. So it had to be something that the package changed.

After some investigation I discovered that the packages installs "oracle-database-preinstall-19c.conf" in /etc/security/limits.d/ and that file has all the oracle limits configuration. Because we are working with docker, you have to comment the following line in order to work:

#oracle hard memlock 134217728

user_38439900

The problem was inappropriate settings in the limits.conf. Changing the run command to include the --ulimit option where the nofile was increased fixed the problem:

docker run --name=oracledb --ulimit nofile=1048576:1048576 \
-p 1521:1521  \
-e ORACLE_SID=XE -e ORACLE_PDB=foo -e ORACLE_PWD=bar \
oracle/database:18.4.0-x

Note the --ulimit nofile=1048576:1048576.

user_50603250
Related