IZ24385: The SSM can crash inside getpw*() on some Linux machines that have NSS LDAP, Kerberos or some other authentication configured.

IBM Tivoli 4.0.0-TIV-SSM-FP0010
IBM Tivoli 4.0.0-TIV-SSM-FP0011
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 12 README 4.0.0-TIV-SSM-FP0012
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 13 README 4.0.0-TIV-SSM-FP0013
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 14 README 4.0.0-TIV-SSM-FP0014
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.14-TIV-SSM-IF0001
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 2 README 4.0.0.14-TIV-SSM-IF0002
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 3 README 4.0.0.14-TIV-SSM-IF0003
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 4 README 4.0.0.14-TIV-SSM-IF0004
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 5 README 4.0.0.14-TIV-SSM-IF0005
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 6 README 4.0.0.14-TIV-SSM-IF0006
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 7 README 4.0.0.14-TIV-SSM-IF0007
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 8 README 4.0.0.14-TIV-SSM-IF0008
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.15-TIV-SSM-IF0001

APAR status

• Closed as program error.

Error description

• SSM can crash inside getpw*() on some broken Linux machines
  (especially with LDAP or Kerberos configured in
  /etc/nsswitch.conf)
  
  SSM 4.0 build 1229 crashes when sysres, hostres, and srstorage
  subagents are loaded. The ipconfig did not load before 1229. The
  system with the issue is SUSE Linux 2.6.16.54 - 0.2.5. SUSE
  version 2.6.15.54 - 0.2.3 works.
  
  The issue appears to be /usr/lib/libcrypto.so.0.9.8.
  

Local fix

• Revert upgrade or upgrade OpenSSL packages to a higher level
  available from Novell.
  

Problem summary

• This issue was caused by the getpw*() and getgr*() functions
  using nss_ldap.so. nss_ldap.so linked to libcrypto.so.0.9.8
  which loaded symbols which conflicted with the SSM's local copy
  of libcrypto.0.9.7.
  

Problem conclusion

• Created a preload script which loads the nonss.so library into
  memory. This library replaces getpw*() and getgr*() with stubs
  to avoid the crash.
  
  This fix has to be manually enabled by uncommenting the
  following line in the preload_ssmagent_nonss.sh file:
  
  #export LD_PRELOAD=$(LD_PRELOAD):"$mydir/nonss.so"
  
  The effect of enabling this patch is that in where user names
  would previously appear in the agent they will now be replaced
  by the string "uid=<number>" where the number is the user id for
  that user.
  
  The fix for this APAR is contained in the following maintenance
  packages:
     | fix pack | 4.0.0-TIV-SSM-FP0006
     | LA interim fix | 4.0.0-TIV-SSM-LA0005
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  NETCOOL SYS SVC

• Fixed component ID

  5724P4300

Applicable component levels

• R400 PSY

     UP