我偶然发现了一些非常令人惊讶的事情，我无法理解 Red Hat EL 5.6 盒子：用户赫里（属于该组数据库管理员）能够终止用户拥有的进程神谕（也属于该组数据库管理员）。
有人能解释一下什么可以让非特权用户终止其他用户的进程吗？即使 Oracle 进程被编写来处理信号，我认为进程无法捕获 SIGKILL(9)。
下面是显示该情况的会话日志。
OracleServer:/home/hri> export ORACLE_SID=HRIXXXDW
OracleServer:/home/hri> sqlplus / as sysdba
SQL*Plus: Release 10.2.0.5.0 - Production on Thu Dec 12 17:30:56 2013
Copyright (c) 1982, 2010, Oracle. All Rights Reserved.
Connected to an idle instance.
SQL> startup
ORA-09925: Unable to create audit trail file
Linux-x86_64 Error: 13: Permission denied
Additional information: 9925
SQL> Disconnected
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 28295 0.0 0.0 61164 676 pts/9 S+ 17:31 0:00 \_ grep HRIXXX
oracle 28263 0.0 0.0 759668 17384 ? Ss 17:31 0:00 ora_pmon_HRIXXXDW
oracle 28265 0.0 0.0 758488 16576 ? Ss 17:31 0:00 ora_psp0_HRIXXXDW
oracle 28267 0.1 0.0 758488 23948 ? Ss 17:31 0:00 ora_mman_HRIXXXDW
oracle 28269 0.0 0.0 760968 19308 ? Ss 17:31 0:00 ora_dbw0_HRIXXXDW
oracle 28271 0.0 0.0 760960 19284 ? Ss 17:31 0:00 ora_dbw1_HRIXXXDW
oracle 28273 0.0 0.0 758488 16656 ? Ss 17:31 0:00 ora_lgwr_HRIXXXDW
oracle 28275 0.0 0.0 758492 19092 ? Ss 17:31 0:00 ora_ckpt_HRIXXXDW
oracle 28277 0.0 0.0 758488 16596 ? Ss 17:31 0:00 ora_smon_HRIXXXDW
oracle 28279 0.0 0.0 758488 16588 ? Ss 17:31 0:00 ora_reco_HRIXXXDW
oracle 28281 0.0 0.0 758488 16772 ? Ss 17:31 0:00 ora_mmon_HRIXXXDW
oracle 28283 0.0 0.0 758488 16612 ? Ss 17:31 0:00 ora_mmnl_HRIXXXDW
OracleServer:/home/hri> /bin/kill -9 28263
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 28309 0.0 0.0 61164 676 pts/9 S+ 17:31 0:00 \_ grep HRIXXX
oracle 28265 0.0 0.0 758488 16584 ? Ss 17:31 0:00 ora_psp0_HRIXXXDW
oracle 28267 0.0 0.0 758488 23948 ? Ss 17:31 0:00 ora_mman_HRIXXXDW
oracle 28269 0.0 0.0 760968 19316 ? Ss 17:31 0:00 ora_dbw0_HRIXXXDW
oracle 28271 0.0 0.0 760960 19284 ? Ss 17:31 0:00 ora_dbw1_HRIXXXDW
oracle 28273 0.0 0.0 758488 16656 ? Ss 17:31 0:00 ora_lgwr_HRIXXXDW
oracle 28275 0.0 0.0 758492 19096 ? Ss 17:31 0:00 ora_ckpt_HRIXXXDW
oracle 28277 0.0 0.0 758488 16596 ? Ss 17:31 0:00 ora_smon_HRIXXXDW
oracle 28279 0.0 0.0 758488 16588 ? Ss 17:31 0:00 ora_reco_HRIXXXDW
oracle 28281 0.0 0.0 758488 16772 ? Ss 17:31 0:00 ora_mmon_HRIXXXDW
oracle 28283 0.0 0.0 758488 16620 ? Ss 17:31 0:00 ora_mmnl_HRIXXXDW
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 28435 0.0 0.0 61164 676 pts/9 S+ 17:32 0:00 \_ grep HRIXXX
下面是使用 stracekill -15进行的kill -9：
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 26278 0.0 0.0 61164 676 pts/9 S+ 17:16 0:00 \_ grep HRIXXX
oracle 12412 0.0 0.0 759660 19724 ? Ss 16:10 0:00 ora_pmon_HRIXXXDW
oracle 12414 0.0 0.0 758484 16608 ? Ss 16:10 0:00 ora_psp0_HRIXXXDW
oracle 12416 0.0 0.0 758484 23992 ? Ss 16:10 0:00 ora_mman_HRIXXXDW
oracle 12418 0.0 0.0 760980 19352 ? Ss 16:10 0:00 ora_dbw0_HRIXXXDW
oracle 12420 0.0 0.0 760968 19316 ? Ss 16:10 0:00 ora_dbw1_HRIXXXDW
oracle 12422 0.0 0.0 758484 16700 ? Ss 16:10 0:00 ora_lgwr_HRIXXXDW
oracle 12424 0.0 0.0 758504 19152 ? Ss 16:10 0:00 ora_ckpt_HRIXXXDW
oracle 12426 0.0 0.0 758484 16708 ? Ss 16:10 0:00 ora_smon_HRIXXXDW
oracle 12428 0.0 0.0 758484 16616 ? Ss 16:10 0:00 ora_reco_HRIXXXDW
oracle 12430 0.0 0.0 758484 16812 ? Ss 16:10 0:00 ora_mmon_HRIXXXDW
oracle 12432 0.0 0.0 758484 16644 ? Ss 16:10 0:00 ora_mmnl_HRIXXXDW
OracleServer:/home/hri> strace kill 12414
execve("/bin/kill", ["kill", "12414"], [/* 32 vars */]) = 0
brk(0) = 0xe36e000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7756000
uname({sys="Linux", node="
OracleServer", ...}) = 0
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=101954, ...}) = 0
mmap(NULL, 101954, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b25c7757000
close(3) = 0
open("/lib64/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\332\301\302;\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1722304, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7770000
mmap(0x3bc2c00000, 3502424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3bc2c00000
mprotect(0x3bc2d4e000, 2097152, PROT_NONE) = 0
mmap(0x3bc2f4e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14e000) = 0x3bc2f4e000
mmap(0x3bc2f53000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3bc2f53000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b25c7771000
arch_prctl(ARCH_SET_FS, 0x2b25c7771260) = 0
mprotect(0x3bc2f4e000, 16384, PROT_READ) = 0
mprotect(0x3bc2a1b000, 4096, PROT_READ) = 0
munmap(0x2b25c7757000, 101954) = 0
brk(0) = 0xe36e000
brk(0xe38f000) = 0xe38f000
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=56450560, ...}) = 0
mmap(NULL, 56450560, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b25c7772000
close(3) = 0
kill(12414, SIGTERM) = 0
exit_group(0) = ?
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 26328 0.0 0.0 61164 676 pts/9 S+ 17:16 0:00 \_ grep HRIXXX
oracle 12412 0.0 0.0 759660 19724 ? Ss 16:10 0:00 ora_pmon_HRIXXXDW
oracle 12414 0.0 0.0 758484 16608 ? Ss 16:10 0:00 ora_psp0_HRIXXXDW
oracle 12416 0.0 0.0 758484 23992 ? Ss 16:10 0:00 ora_mman_HRIXXXDW
oracle 12418 0.0 0.0 760980 19352 ? Ss 16:10 0:00 ora_dbw0_HRIXXXDW
oracle 12420 0.0 0.0 760968 19316 ? Ss 16:10 0:00 ora_dbw1_HRIXXXDW
oracle 12422 0.0 0.0 758484 16700 ? Ss 16:10 0:00 ora_lgwr_HRIXXXDW
oracle 12424 0.0 0.0 758504 19152 ? Ss 16:10 0:00 ora_ckpt_HRIXXXDW
oracle 12426 0.0 0.0 758484 16708 ? Ss 16:10 0:00 ora_smon_HRIXXXDW
oracle 12428 0.0 0.0 758484 16616 ? Ss 16:10 0:00 ora_reco_HRIXXXDW
oracle 12430 0.0 0.0 758484 16812 ? Ss 16:10 0:00 ora_mmon_HRIXXXDW
oracle 12432 0.0 0.0 758484 16644 ? Ss 16:10 0:00 ora_mmnl_HRIXXXDW
OracleServer:/home/hri> strace kill -9 12414
execve("/bin/kill", ["kill", "-9", "12414"], [/* 32 vars */]) = 0
brk(0) = 0x1b155000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2e4000
uname({sys="Linux", node="
OracleServer", ...}) = 0
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=101954, ...}) = 0
mmap(NULL, 101954, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2ac77c2e5000
close(3) = 0
open("/lib64/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\332\301\302;\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1722304, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2fe000
mmap(0x3bc2c00000, 3502424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3bc2c00000
mprotect(0x3bc2d4e000, 2097152, PROT_NONE) = 0
mmap(0x3bc2f4e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14e000) = 0x3bc2f4e000
mmap(0x3bc2f53000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3bc2f53000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ac77c2ff000
arch_prctl(ARCH_SET_FS, 0x2ac77c2ff260) = 0
mprotect(0x3bc2f4e000, 16384, PROT_READ) = 0
mprotect(0x3bc2a1b000, 4096, PROT_READ) = 0
munmap(0x2ac77c2e5000, 101954) = 0
brk(0) = 0x1b155000
brk(0x1b176000) = 0x1b176000
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=56450560, ...}) = 0
mmap(NULL, 56450560, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2ac77c300000
close(3) = 0
kill(12414, SIGKILL) = 0
exit_group(0) = ?
OracleServer:/home/hri> ps auxf | grep HRIXXX
hri 26380 0.0 0.0 61164 676 pts/9 S+ 17:17 0:00 \_ grep HRIXXX
现在介绍一些有关用户和操作系统的信息：
OracleServer:/home/hri> uname -a
Linux OracleServer 2.6.18-186.el5 #1 SMP Wed Jan 27 18:11:22 EST 2010 x86_64 x86_64 x86_64 GNU/Linux
OracleServer:/home/hri> cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.6 (Tikanga)
OracleServer:/home/hri> id
uid=20314(hri) gid=20175(hri) groups=20001(dba),20175(hri)
OracleServer:/home/hri> id oracle
uid=20001(oracle) gid=20001(dba) groups=20001(dba),20000(xxxxx),20768(xxxxx),20329(xxxxx),20767(xxxxx),20930(xxxxx),20271(xxxxx),20316(xxxxx)
OracleServer:/home/hri> alias kill
bash: alias: kill: not found
OracleServer:/home/hri> type kill
kill is a shell builtin
OracleServer:/home/hri> which kill
/bin/kill
OracleServer:/home/hri> l /bin/kill
-rwxr-xr-x 1 root root 14864 Sep 22 2010 /bin/kill
OracleServer:/home/hri> file /bin/kill
/bin/kill: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped
编辑， 谢谢林建军评论：
这是赫里启动 $ORACLE_SID 的用户（这是发布的第一个会话日志中显示的内容）。
二进制文件的权限oracle显示为苏伊德和服务标识符放。
OracleServer:/home/hri> l /oracle/product/10.2.0.5/bin/oracle
-rwsr-s--x 1 oracle dba 116208733 Jul 1 09:29 /oracle/product/10.2.0.5/bin/oracle
事实上，/proc/*/status的Uid线条表明真实 UID是20314（这是用户 ID赫里） 尽管有效 UID是20001（即神谕）。
OracleServer:/home/hri> ps auxf | grep HRIXXX | grep 9609
oracle 9609 0.0 0.0 759668 19692 ? Ss 08:41 0:00 ora_pmon_HRIXXXDW
OracleServer:/home/hri> grep [UG]id: /proc/9609/status
Uid: 20314 20001 20001 20001
Gid: 20175 20001 20001 20001
因此，Oracle 确实在运行其系统 ID (SID)子流程真实 UID数据库所有者，而有效 UID是 Oracle 的。
谢谢你！
参考：
- 真实 UID 与有效 UID：http://unixpapa.com/incnote/setuid.html
- /proc/[pid]/status描述：http://www.unix.com/man-page/Linux/5/proc/
- Oracle SID：http://www.orafaq.com/wiki/ORACLE_SID
答案1
Oracle 以如下方式运行其 SID 子进程真实 UID数据库所有者 (赫里这里），而有效 UID是 Oracle 的（神谕）。 这就是为什么赫里能够终止其自身的进程。
您可以ps axf -O ruid,ruser,euid,euser并排显示 RUID 和 EUID。