PH51218: RSEAPI CAUSES SAF ERRORS: LIBFEKFMAIN.SO CL(DIRSRCH )... INSUFFICIENT AUTHORITY TO STAT

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• In IBM® Remote System Explorer API (RSE API), the following
  SAF error is raised when the first user logs in:
  
  ICH408I USER(USERXYZ ) GROUP(USERS   ) NAME(....      ) 569
    libfekfmain.so CL(DIRSRCH )
    FID(C5C5F0F0F5F402780000000000010001)
    INSUFFICIENT AUTHORITY TO STAT
    ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
    EFFECTIVE UID(0000101036)  EFFECTIVE GID(0000500021)
  
  and
  
  ICH408I USER(USER10  ) GROUP(IDZGROUP) NAME(...       ) 044
     null/mvsExtension.dat
     CL(DIRSRCH ) FID(E2D4E2E5D3F8005F0000000000100001)
     INSUFFICIENT AUTHORITY TO LSTAT
     ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
  
  The file system with the permission restriction is the home
  directory of the started task userid.
  
  Local fix:
  
  The error can be ignored and doesn't prevent RSEAPI from
  working.
  A workaround is allow --X access to the home directory of the
  STC user.
  

Local fix

• The error can be ignored and doesn't prevent RSEAPI from
  working.
  A workaround is to allow --X access to the home directory of the
  STC user.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: 1. All users download file containing '^'    *
  *                 symbol.                                      *
  *                 2. User of the first mvs command requested   *
  *                 to the server after startup                  *
  *                 3. All started task servers.                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: 1. When using RSEAPI to download        *
  *                      content, the not symbol (^) is          *
  *                      incorrectly translated to '4'           *
  *                      (number 4). Which causes issue in       *
  *                      PL/I parsing.                           *
  *                      2. During the first mvs command         *
  *                      execution of an RSEAPI server, it       *
  *                      attempts to load libfekfmain*.so        *
  *                      31bit first. In a 64bit system, the     *
  *                      load would fail. The system would       *
  *                      check on the library under the          *
  *                      working directory user.dir, which is    *
  *                      default to user home directory if not   *
  *                      specific set before starting up the     *
  *                      server.                                 *
  *                      3. Current implementation treats such   *
  *                      server as started as USS and force      *
  *                      the check. The server startup fails     *
  *                      if permission is not set up for the     *
  *                      started task user.                      *
  ****************************************************************
  1. When constructing the download command, the argument filled
  in was shifted one index up incorrectly, causing the notSymbol
  substitue set as '4' accidentally.
  2. The error can be ignored and doesn't prevent RSEAPI from
  working.
  3. The RSEAPI started up by catalina startup script. It was a
  USS process spawn with /bin/sh shell and has different address
  space than the RSEAPI started task.
  The check is currently performed on the ASID of the server
  itself and failed to detect it was started by a started task.
  

Problem conclusion

• 1. Fix the order of the argument when constructing the
  download request.
  2. Set the working directory to RSE_CFG directory (mandatory
  for existence and 755) when starting in tomcat.base/start.sh
  right before calling catatalina.sh. Note: it is similar as in
  RSED startup.
  3. The check now is performed on the address of the server's
  parent process to cover the started as job or task cases. When
  its parent pid is 1, it implies the server started by CLI; the
  check is done on the server ASID itself in this case.
  

Temporary fix

Comments

• ×**** PE23/02/09 FIX IN ERROR. SEE APAR PH52498  FOR DESCRIPTION
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI90190

Modules/Macros

• HUH1SMPE HUH2RCVE HUH3ALOC HUH4ZFS  HUH5MKD  HUH6DDEF HUH7APLY
  HUH8ACPT HUHCRYPT HUHFT000 HUHFT001 HUHFT002 HUHFT003 HUHFT004
  HUHFT005 HUHFT006 HUHFT007 HUHFT008 HUHFT009 HUHFT011 HUHFT012
  HUHFT013 HUHFT014 HUHFT015 HUHFT016 HUHFT017 HUHFT018 HUHFT020
  HUHMKDIR HUHMOUNT HUHPAX01 HUHRACF  HUHSETUP HUHSHPAX HUHSTC
  

Fix information

• Fixed component name

  EXP FOR ZOS RSE

• Fixed component ID

  5655EXP33

Applicable component levels

• R100 PSY UI90190

     UP23/01/28 P F301

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.