PM40926: HFS VIOLATIONS WHEN SYNC-TO-OS THREAD IS ENABLED, AND APPLICATION ATTEMPTS TO LOAD NATIVE DLL.

Fixes are available

APAR status

Closed as program error.

Error description

Application utilizes sync-to-osthread in order to push a user
identity onto the operating system thread.  The application also
accesses a native dll. When the classloader is searching the
application for the native dll, a security violation occurs
because the HFS was searched under the identity of the user, and
not the identity of the application server.

An example violation may look like the following:

---------

ICH408I USER(USER   ) GROUP(SOMGROUP ) NAME(   )
  /WebSphere/Base/AppServer/profiles/default/installedApps/cell
  /Application.ear/WebApplication.war/WEB-INF/classes
  CL(DIRSRCH ) FID(00028BCE000202950000000000000000)
  INSUFFICIENT AUTHORITY TO LSTAT
  ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
  EFFECTIVE UID(0000000001)  EFFECTIVE GID(0000000100)
ICH408I USER(USER   ) GROUP(SOMGROUP ) NAME(   )
  /WebSphere/Base/AppServer/profiles/default/installedApps/ce
ll/Application.ear/WebApplication.war/WEB-INF/lib/Utility.jar
  CL(DIRSRCH ) FID(00028BCE000202950000000000000000)
  INSUFFICIENT AUTHORITY TO LSTAT
  ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
  EFFECTIVE UID(0000000001)  EFFECTIVE GID(0000000100)
CH408I USER(USER   ) GROUP(SOMGROUP ) NAME(    )
 /WebSphere/Base/AppServer/profiles/default/installedApps/ce
ll/Application.ear/WebApplication.war/WEB-INF/lib/Utility.jar
 CL(DIRSRCH ) FID(00028BCE000202950000000000000000)
 INSUFFICIENT AUTHORITY TO LSTAT
 ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
 EFFECTIVE UID(0000000001)  EFFECTIVE GID(0000000100)

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server for z/OS V6.1.0 and V8.0             *
****************************************************************
* PROBLEM DESCRIPTION: When the "sync to OS thread" function   *
*                      is enabled, native library loads can    *
*                      fail when using application class       *
*                      loaders                                 *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
When "sync to OS thread" is enabled on z/OS, the server ID must
be put on the thread stack before filesystem operations are
allowed to take place.  This was not occurring for native
library loads in the WAS application class loaders, and HFS
violations could result.

Problem conclusion

The server identity push was included in the WAS application
class loader's findLibrary method.

APAR PM40962 is currently targeted for inclusion in Service
Level (Fix Pack) 6.1.0.43 of WebSphere Application Server
V6.1 and Fix Pack 8.0.0.2 of WebSphere Application Server V8.0.

The fix will also be delivered as sysrouted APAR PM47302 in
Fix Pack 7.0.0.21 of WebSphere Application Server V7.0 for z/OS.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PM40926
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
610
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2011-06-07
Closed date
2011-09-07
Last modified date
2012-04-03

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

PM47302

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R610 PSY UK76696
UP12/03/18 P F203

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
27 October 2021

Tips

PM40926: HFS VIOLATIONS WHEN SYNC-TO-OS THREAD IS ENABLED, AND APPLICATION ATTEMPTS TO LOAD NATIVE DLL.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R610 PSY UK76696

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?