IT34554: VADP INSTALLATION FAILS WITH "PERMISSION DENIED" BECAUSE SECURITY HARDENING RESTRICTS NESTED SUDO

APAR status

• Closed as program error.

Error description

• The installation of VADP fails with following error:
  
  Failed to execute remote action on VADP proxy. Ensure that the
  VADP proxy is reachable and meets the installation criteria
  (such as properly configured ports and environment). See logs
  for more information.
  
  When executing remote VADP scripts (i.e., install.sh,
  update.sh, etc.), they require that users allow nested sudo
  execution, since the scripts are executed using sudo and the
  scripts themselves contain sudo commands. If nested sudo is
  restricted, like "(root) !/usr/local/bin/sudo, !/usr/bin/sudo,
  !/bin/sudo", VADP installation fails with "Permission denied"
  in virgo log.
  
  [date+time] ERROR http-nio-8082-exec-10
  c.s.dp.xsb.api.commons.exception.ExceptionMessageTranslator
  com.catalogic.ecx.vadp.common.error.RemoteInstallerException:
  Failed to retrieve output.json from <VADPHostFQDN or IP
  address>. e=3: Permission denied
  
  Versions affected: 10.1.4.*
  

Local fix

• Temporarily disable secure hardening by commenting out
  corresponding line like "ALL ALL= !SUDOSUDO" in sudoers file
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.4, 10.1.5 and 10.1.6.   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is       *
  * currently projected to be fixed in IBM Spectrum Protect Plus *
  * level 10.1.7. Note that this is subject to change at the     *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• This problem has been fixed so that instead of executing nested
  sudo commands within the VADP installation and update scripts,
  the new behavior is to execute the top level scripts as sudo and
  carry those permissions throughout the execution of subsequent
  scripts without executing nested sudo commands.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels