SAS Restricted Options on UNIX

In a tweet by Gordon Cox last month, I was reminded of the restricted options facility available with SAS® software on UNIX platforms. This is capability where an administrator can set mandatory SAS system options at multiple levels of granularity: globally, per-group, and/or per-user. The reason for this post is that I don’t look at the documentation for this very often and every time I do it takes me a while to track it down. I always think its going to be in the UNIX companion in the Base SAS area… but it’s not! That gets me every time. Instead it’s tucked away in the Configuration Guide for SAS 9.2 Foundation for UNIX Environments (PDF) in Chapter 2 – Restricted Options. You can find this document in the Install Center section of support.sas.com under SAS Installation Note 36467: Documentation for a SAS® 9.2 installation on UNIX.

The context of the tweet was that the restricted options facility is another mechanism whereby a default setting of the NOXCMD option for SAS platform servers could be overridden for a subset of trusted users or groups in a SAS platform installation. The NOXCMD option is discussed in an earlier post: NOXCMD: NO eXternal CoMmanDs!

A quick summary of restricted options:

  • SAS Systems Options under UNIX set by an administrator, that cannot be changed by a user
  • Processed in the order global, group, then user. The last instance of an option is the one that wins.
  • Global restrictions are read from the file !SASROOT/misc/rstropts/rsasv9.cfg
  • Group restrictions are read from the file !SASROOT/misc/rstropts/groups/<groupname>_rsasv9.cfg
  • User restrictions are read from the file !SASROOT/misc/rstropts/users/<userid>_rsasv9.cfg

On Linux (at least) I can use the command “id -gn <userid>” to find out the effective group name for a user, given their user id. For example, “id -gn sassrv” might generate “sas“.

In my SAS 9.2 installation on Linux, whilst everyone else is still constrained by the NOXCMD option, I can ensure that the SAS Enterprise Guide user Bob Baxter, who has a user id of bob, can still use operating system commands in the SAS programs he runs on the SASApp server, by creating the file /usr/local/SAS/SASFoundation/9.2/misc/rstropts/users/bob_rsasv9.cfg with the following contents:

-xcmd

Of course, this only applies to SAS processes launched and run as the requesting user. Whilst it can be used to override NOXCMD for specific users/groups using a standard workspace server, it cant be used to distinguish between different users on the same stored process server, since all users will share SAS stored process server processes running under a shared identity (like sassrv). In that situation directing the users to separate SAS application servers would be more appropriate. There is an example of this in Jim Fenton & Robert Ladd’s SAS Global Forum 2010 paper 311-2010: A Practical Approach to Securing a SAS® 9.2 Intelligence Platform Deployment

Thanks to Gordon for reminding me about the restricted options facility.

Updated SAS Enterprise Guide Admin Paper

One of the papers I regularly recommended to administrators of SAS® Enterprise Guide was TS-788 What SAS® Administrators Should Know about Libraries, Metadata, and SAS® Enterprise Guide 4.1 (PDF), especially for its discussion of the AssignMode extended attribute.

Thanks to a recent post by Chris Hemedinger on The SAS Dummy blog, I’ve discovered that there’s now an updated version of it available: What SAS Administrators Should Know about Libraries, Metadata, and SAS Enterprise Guide (SAS 9.2, SAS Enterprise Guide 4.2 & 4.3) (PDF).

It’s well worth a read and has a great FAQ section at the end. It also mentions METAOUT=DATAREG – new in SAS 9.2.

BTW, if you’re a SAS platform administrator who supports SAS Enterprise Guide users, and you’re not already a reader of The SAS Dummy, I’d definitely recommend adding it to your RSS subscriptions.

Desktop Files for Launching SAS Apps on Ubuntu

Whilst I often use the command line on Linux, it’s also nice to have icons in the menus to start SAS® applications like SAS Management Console and SAS Display Manager. These days I mostly use GNOME Do as an application launcher (its a bit like Quicksilver for Mac OS X). Naturally I like to be able to launch SAS apps from GNOME Do too. One day soon I’ll give Ubuntu Unity another try, and when I do eventually make the switch I probably wont use GNOME Do any more (but I’ll remember it as good friend), so then I’ll want to launch SAS apps from Unity. Thankfully I can use the same custom .desktop files in all of these situations.

Originally I used to point and click my way through editing the menus to add a custom launchers for SAS apps, but I soon tired of that. I’m a programmer too. Pointing and clicking doesn’t stay fun for long ;)

I found out about .desktop files after delving into what happened behind the scenes when I was editing the menus using point and click methods. There’s a GNOME Dev Center tutorial on it “Desktop files: putting your application in the desktop menus“. The freedesktop.org site also has a list of the Recognized desktop entry keys that can go into a .desktop file.

Below are some of the .desktop files that I use to launch SAS applications on my Ubuntu installation. I have only tested these on Ubuntu using GNOME but, since they are standard freedesktop files, I imagine they should also work in KDE and other Linux distros.

If you place the .desktop files into the ~/.local/share/applications directory (e.g. /home/userid/.local/share/applications) they will only be available to that single user. Alternatively, if they are placed into the /usr/share/applications directory then they will be available to all users.

The nice thing I have found about editing .desktop files is, so far at least, the changes have shown up in the menus immediately (i.e. without having to logout/login). In my installation the menu entries for these .desktop files can be found in the Ubuntu Applications > Other menu. They show up in GNOME Do too.

Here are the .desktop files I use:

SAS Management Console 9.2

This is a sas-mc-92.desktop file that I use to launch SAS Management Console 9.2 on Ubuntu.

#!/usr/bin/env xdg-open

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Type=Application
Terminal=false
Name=SAS Management Console 9.2
Icon=/usr/local/SAS/SASManagementConsole/9.2/SMCApplication.ico
Exec=/usr/local/SAS/SASManagementConsole/9.2/sasmc

SAS 9.2 Display Manager

This is a sas-dms-9.2.desktop file that I (sometimes) use to launch the old SAS Display Manager System (DMS) interface on Ubuntu. If you’ve used DMS on Linux you’ll probably understand why I only use it sometimes ;). I’d love to have a native SAS Enterprise Guide like interface to SAS on Linux (without having to start Windows in VirtualBox). I know, given the numbers, it’s unlikely to ever happen, but I can’t help wishing nonetheless :).

#!/usr/bin/env xdg-open

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Type=Application
Terminal=false
Name=SAS Display Manager 9.2
Icon=/usr/local/SAS/sas-logo-48x48.png
Exec=/usr/local/SAS/SASFoundation/9.2/sas

You wont find the /usr/local/SAS/sas-logo-48×48.png file in your installation so you should substitute that with the path to an appropriate icon available in your installation.

SAS Management Console 9.1

This is a sas-mc-913.desktop file that I use to launch SAS Management Console 9.1 on Ubuntu.

#!/usr/bin/env xdg-open

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Type=Application
Terminal=false
Name=SAS Management Console 9.1
Icon=/usr/local/SAS/SASManagementConsole/9.1/SMCApplication.ico
Exec=/usr/local/SAS/SASManagementConsole/9.1/sasmc

If you are a SAS user on Linux then I hope you find these useful too. If you have any info/experiences to share regarding .desktop files launching SAS apps in other desktop environments (KDE, Xfce etc.) or other distros (RHEL, Fedora etc.) then please leave a comment.