2 Preinstallation Tasks

2.2.1 Check for Required APARS

Refer to Oracle Database Patch Set Notes 10g Release 2 (10.2.0.5) Patch Set 4 for IBM z/OS on System z for more information on required APARS.

2.3.1 Perform Product Security Activities

Some activities that are related to installing Oracle Database 10g for z/OS can be performed independently, even before the software arrives. All of these activities are related to product security features, and one activity, which is optional, requires an initial program load (IPL) of your system before it takes effect. Depending on the organization and procedures of your installation, you may need to work with system security personnel or systems programmers to perform these activities.

The following descriptions are provided in RACF (IBM z/OS Security Server) terms with the assumption that RACF is in use. Any product which fully implements z/OS System Authorization Facility (SAF) can be substituted. If your installation uses a product other than RACF, refer to the documentation for that product for information about how to perform the steps that are discussed in this chapter.

2.3.2 Configure BPX Parameters

The following BPX parameter files must be modified and activated on the system. They are set in SYS1.PARMLIB(BPXxxx). After doing so, you do not need to IPL the system:

• MAXTHREADTASKS(1000)

• MAXTHREADS(1000)

• MAXCPUTIME(2147483647)

• MAXASSIZE(2147483647)

• MAXSHAREPAGES(131072)

• SHRLIBMAXPAGES(8192)

2.3.3 Check User Virtual Storage

Determine the virtual region size for the user performing the installation. If it is less than the required size, you must increase the maximum allowable size of the virtual region to 512 MB. The method you use to determine the virtual region size depends on whether you entered the z/OS UNIX System Services shell environment through Telnet or rlogin or through TSO OMVS:

• If you entered the z/OS UNIX System Services shell environment through Telnet or rlogin, the virtual storage is the amount set in the SYS1.PARMLIB(BPXPRMxx) field MAXASSIZE. This amount can be limited in the OMVS segment of your RACF profile.

  For example, if you do not define ASSIZEMAX in your RACF OMVS segment, and you have MAXASSIZE set to 2147483647, all Telnet or rlogin sessions will get 2 GB of virtual storage.

• If you entered the z/OS UNIX System Services shell environment through TSO OMVS, then the virtual storage is the region size that you set for the REGION field when you logged on to TSO. This value is in KB. This amount can be limited in the TSO segment of your RACF profile.

  You must ask your system administrator to issue the following command, which shows the maximum allowed value:

  $ tso listuser username tso
  

  For example:

  tso listuser arogers tso
  USER=AROGERS  NAME=ANDREW ROGERS         OWNER=RACF      CREATED=96.106
  DEFAULT-GROUP=OEG647    PASSDATE=03.356  PASS-INTERVAL= 92
  ...
  TSO INFORMATION
  --------------- 
  ACCTNUM= NOACCT
  PROC= $AROGERS
  SIZE= 02048000
  MAXSIZE= 02048000
  USERDATA= 0000
  

  This shows that you can have up to 2 GB of virtual storage.

You must be aware that the SMF exit IEFUSI can limit virtual storage in either of the previous cases. Therefore, ensure that the SMF exit IEFUSI allows for enough virtual storage to use Oracle products.

2.3.4 Add an APF-Authorized Library

Oracle Database 10g for z/OS requires the database and network region programs to run with APF authorization, which means that the load modules must reside in an APF-authorized library. While it is possible to copy these modules into an existing authorized library, Oracle recommends that you create an authorized library specifically for Oracle Database 10g for z/OS. Because z/OS requires all modules that are loaded by an authorized program to come from authorized libraries, the library contains a number of modules in addition to the database and network region programs, including the Oracle Database kernel. The authorized library must be a PDSE type rather than a PDS type.

A load library can be authorized in either of two ways: add an entry for the data set to the PROGxx member of SYS1.PARMLIB, or add an entry for the data set to the IEAAPFxx member of SYS1.PARMLIB. The first way (using the PROGxx member) utilizes a newer mechanism. The second way (using the IEAAPFxx member) utilizes an older mechanism. You may need to talk to your systems programmer to determine which method to use and the correct suffix to substitute for xx. If you plan to name the authorized library ORACLE.V10G.AUTHLOAD, for example, then the following code shows a suitable entry in PROGxx:

APF ADD DSNAME(ORACLE.V10G.AUTHLOAD) SMS

If your installation is using IEAAPFxx instead of PROGxx, a comparable entry there would be:

ORACLE.V10G.AUTHLOAD ,

The comma in the above entry is included only if the entry is not the last record in the member. Omit the comma in the new entry if it is last in the member, and ensure that the preceding entry has a comma.

Changes to PROGxx or IEAAPFxx do not take effect until the next IPL. If your installation has enabled z/OS dynamic APF facilities, then a library can be authorized without an IPL by using a SETPROG APF,ADD operator command as shown in the following example:

SETPROG APF,ADD,DSN=ORACLE.V10G.AUTHLOAD,SMS

The authorization that is conferred by the SETPROG command is independent of the PROGxx or IEAAPFxx members and lasts only until the next IPL. This means that you would use this technique only if you expect to install the software and actually configure and run a database service or network service before the next IPL of your system.

Regardless of the technique used, a data set does not need to exist to be authorized. Oracle Universal Installer prompts you for the location of the data set and can optionally allocate it for you. If you can choose the data set name that you want to use, then this step can be performed before the data set is created and populated. However, once you create a data set, you must authorize it.

2.3.5 Ensure Adequate Address Space IDs (ASIDs)

Oracle Database 10g for z/OS instances can be composed of multiple address spaces and can make extensive use of z/OS Cross Memory Services. When a cross-memory address space is terminated, the address space ID (ASID) that was used for this address space is made unavailable. Eventually, the pool of z/OS ASIDs can become exhausted, which prevents new address spaces from being created. In order to avoid the above condition, the RSVNONR parameter in the IEASYSxx member of SYS1.PARMLIB must be set to a higher value.

2.3.6 Add Program Properties

The database and network service region programs must run nonswappable and noncancelable, and should not be subject to system time limits. In addition, the database service runs in protect key 7. These attributes are indicated by adding entries for these programs to the z/OS Program Properties Table (PPT), through a member of the SYS1.PARMLIB data set named SCHEDxx, where xx is a 2-letter or 2-digit suffix. The entries that you add must be similar to those in the following example. The comments, which are included for clarity, are allowed but are not required.

/* SCHEDxx PPT entry for Oracle database region */
PPT PGMNAME(ORARASC)        /* Program (module) name    */
    NOCANCEL                /* Not cancelable           */
    KEY(7)                  /* Protection key           */
    NOSWAP                  /* Not swappable            */
    SYST                    /* Not subject to timing    */
   /* SCHEDxx PPT entry for Oracle network region */
PPT PGMNAME(MINMAIN)        /* Program (module) name    */
    NOCANCEL                /* Not cancelable           */
    NOSWAP                  /* Not swappable            */
    SYST                    /* Not subject to timing    */

The entries in the SCHEDxx member are usually read at z/OS IPL. You can cause z/OS to reread the member without an IPL by using the SET SCH operator command. The PPT entries must take effect before Oracle database and network services are started.

2.3.7 Create and Activate a Resource Class

The authorization-checking mechanism of SAF is based on resource names, which are simply character strings that identify the data, interface, or other entity that is protected. Resource names are organized into classes. A resource class is a name for a group of resources with similar name structure and attributes. RACF has a number of predefined resource classes for items such as data sets, tape volumes, and terminals.

Oracle Database 10g for z/OS has three types of resources that are subject to authorization checking:

1. OSDI commands

2. The client-service bind interface

3. The database server SYSOPER/SYSDBA connection privilege

These resources must have an associated resource class. By default, Oracle Database 10g for z/OS is set up with the assumption that the resources are in the FACILITY class, which is a predefined RACF class. FACILITY is a general-use class whose resource name structure accommodates all three of the resource types of Oracle Database 10g for z/OS. If you use the default FACILITY class, then you may need to activate the class if your installation has not previously defined resources in the class.

This is done with a SETROPTS CLASSACT RACF command and does not require a z/OS IPL.

The security standards or procedures of your installation may make it preferable to create distinct resource classes for Oracle Database 10g for z/OS resources. RACF allows security administration privileges to be granted on a resource class basis. If you create distinct classes for Oracle Database 10g for z/OS, those RACF administration privileges can be granted to users without enabling administrative privileges on other non-Oracle Database resources that may be associated with the FACILITY class.

If you decide to create resource classes for Oracle Database 10g for z/OS, then two classes must be created: one for OSDI commands and one that is shared by both bind and database SYSOPER/SYSDBA connect authorizations.

The procedure involves coding Assembler Language macro instructions that are assembled to create non-executable load modules that are the class table and router table, and an IPL of z/OS is required to activate the change.

If you choose to add new resource classes for Oracle Database 10g for z/OS, then the ICHERCDE macro that you code for the class table entries must specify parameters as in the following example, which defines the classes $ORACMD and $ORACONN.

$ORACMD ICHERCDE CLASS=$ORACMD,
       GROUP=$ORACONN,
       ID=192,                    Some number between 128 & 255
       MAXLNTH=19,
       RACLIST=ALLOWED,
       FIRST=ALPHANUM,
       OTHER=ANY,
       POSIT=42,                  Probably unique to this class
       OPER=NO,
       DFTUACC=NONE
$ORACONN ICHERCDE CLASS=$ORACONN,
       MEMBER=$ORACMD,
       ID=191,                    Some number between 128 & 255
       MAXLNTH=19,
       FIRST=ALPHANUM,
       OTHER=ANY,
       POSIT=42,                  Probably unique to this class
       OPER=NO,
       DFTUACC=NONE 

You must also add entries to the installation-supplied router table module ICHRFR01, as in the following example:

ICHRFRTB CLASS=$ORACMD,ACTION=RACF
ICHRFRTB CLASS=$ORACONN,ACTION=RACF

After the class table is updated and the system is IPLed, the new classes can be activated with the SETROPTS CLASSACT command.

You must also provide Oracle Database 10g for z/OS with the class names. This is done in the subsystem parameter file discussed in the Oracle Database System Administration Guide for IBM z/OS on System z.

2.3.8 Associate User IDs with Services

Oracle Database 10g for z/OS-managed services execute as system address spaces, similar to started tasks or STCs. Some of the z/OS system functions that are invoked by Oracle Database 10g for z/OS services perform authorization checks based on the z/OS user ID that is associated with the service address space. Depending on the security configuration and standards of your installation, those system functions may fail if no user ID is associated with the address space. You, or security personnel for your installation, must take steps to ensure that Oracle Database 10g for z/OS services have an associated user ID that can be authorized for system functions that are invoked by the database and network services.

If you are running the TNS programs of previous releases as started tasks (as opposed to submitting them as batch jobs), then your installation probably has STARTED or USER profiles for the associated JCL procedures. You should not rely on those for Oracle Database 10g for z/OS because the Oracle Database 10g for z/OS procedures should have different names. Plan to create at least two new STARTED or USER profiles, one for the database service and one for the network service. These may be all that you need, because different instances of a type of service can generally share the same JCL procedure. You may want to create additional profiles, though, if you want different instances of a service to run with different user IDs. This requires using distinct JCL procedures even though the procedures themselves may be otherwise identical. The RDEFINE command that is used to add profiles is described in the Security Server RACF Command Language Reference.

With RACF, it is also possible to associate a user ID with a started task using a started procedures table that is built with Assembler macros somewhat like the resource class table discussed in the previous section. Activating such changes requires an IPL, however, and is not the preferred method.

Certain database features are implemented using z/OS UNIX System Services, formerly called Open Edition. These features include Java, XML, Oracle Text, Spatial Data Option, UTL_FILE package, and external LOB(BFILE) support. In order for these features to work, the database service address space must be capable of being "dubbed" as a z/OS UNIX System Services process. This requires that the z/OS user ID that is associated with the address space have a default z/OS UNIX System Services segment that is defined to the security subsystem.

In addition, certain utilities run only in a z/OS UNIX System Services shell environment, such as Oracle Universal Installer, Enterprise Manager, and some client-side Java applications. For users requiring these applications, an OMVS RACF segment must be defined. The OMVS RACF segment can be defined to a group and then the users who are likely to require these Oracle Java applications can be associated with the group. Such users are typically Oracle DBAs and Oracle operators.

Depending on whether this is the first time Oracle software is being installed on this system and on the products that you are installing, you may need to create several groups and users who will be responsible for the installation, maintenance, and operation of the Oracle database.

Installation User/Group Considerations

Oracle Universal Installer requires that all users performing Oracle software installation and maintenance belong to the same group. Oracle recommends that you define a user group for all users performing installation and maintenance.

The user who performs the installation becomes the owner of the files created as part of the installation. You may want to define a z/OS user who will be the software owner. Any user performing an Oracle installation must have an OMVS RACF segment defined. This user must be able to create and update the Oracle PDS/PDSE data sets.

For maintenance, only the software owner is granted write access to the archive libraries. You may need to change the permissions for the archive libraries to allow anyone in the group write access after the installation has completed.