arstblsp

[cmodpuser]

Trying to run arstblsp and getting arsusec failure:
 
BPXBATCH sh /usr/lpp/ars/V8R4M0/bin/arstblsp -a 3 -g 'System Log' -u 'ARSADM' -p 'xxxxxxxx'

The userexit >/usr/lpp/ars/V8R4M0/bin/exits/arsusec< failed.  rc=3  Srvr-><-   
An error occurred.  Contact your System Administrator and/or consult the System

Messages in system log:

BPXP015I HFS PROGRAM /usr/lpp/ars/V8R4M0/bin/arstblsp IS NOT MARKED 
PROGRAM CONTROLLED.                                                 
BPXP014I ENVIRONMENT MUST BE CONTROLLED FOR DAEMON (BPX.DAEMON)     
PROCESSING.                                                         

BPXF024I (XXX) ARSUSEC.ARSZUXF fetch for ARSUSECX failed RC=00060002     
BPXF024I (XXX) ARSUSEC.ARSZUXF Diag 871B1110 10DCB628 10DCB6B0 FC 730     
00030DAD59C3C5C500000001                                                 
ARS0161E ARSADM THE USEREXIT >/USR/LPP/ARS/V8R4M0/BIN/EXITS/ARSUSEC< 731 
 FAILED.  RC=3  SRVR-><-                 

The permissions for arstblsp are 755 rwxr-xr-x       
Extended attributes are:
Shared address space  . . 1         
APF authorized  . . . . . 1         
Program controlled  . . . 0         
Shared library  . . . . . 0         

Tried setting arstblsp to Program Controlled and got different failure:

ICH422I THE ENVIRONMENT CANNOT BECOME UNCONTROLLED.                 
BPXP014I ENVIRONMENT MUST REMAIN CONTROLLED FOR DAEMON (BPX.DAEMON)
PROCESSING.                                                         
CSV042I REQUESTED MODULE DSNHDECP NOT ACCESSED. THE MODULE IS NOT   
PROGRAM CONTROLLED                                                 
CSV028I ABEND306-42  JOBNAME=ARSARSSL  STEPNAME=STEP1               

I don't have issues running any other programs: ARSDOC, ARSMAINT, ARSEXOAM.
Has anyone come across this?

                               

[Justin Derrick]

Do you have a custom security exit installed?

-JD.

[cmodpuser]

Yes we do. I was wondering if I'll have to turn security off to run arstblsp.

[Justin Derrick]

I'd give that a try first.  Just make sure you know the admin password that's stored in the CMOD database.

-JD.

[Ed_Arnold]

I think Justin's advice is far better than mine but just a wild guess:

Srvr-><-

Even if your server is the default ARCHIVE try specifying it (-h ARCHIVE).

Ed

[cmodpuser]

Arstbksp worked with ARSSOCK up and the security turned off.
Ed, Why wouldn't our custom security exit work in this case?

[Ed_Arnold]

> Why wouldn't our custom security exit work in this case?

If you're migrating to 9.5 all bets are off in regards to exits.

As Justin says, try it without any security and see what happens.

Ed

[cmodpuser]

We are on 8.4.0.3

[Ed_Arnold]

Glad you got it to work.

Only The Shadow or someone who could do a line by line debug trace of the security exit would know for sure why it didn't work.

Ed

[Ed_Arnold]

We discussed this amongst ourselves.

BPX.DAEMON forces you to have a tighter envisonment.  Usually, you need BPX.DAEMON to do a setuid() if you're not running root.

But arstblsp shouldn't be doing setuid on z/OS.  There are other things that I believe require BPX.DAEMON, but not this.

You might open a PMR with USS, asking them if they could SLIP on the BPXP014I to try and figure out why USS thinks arstblsp needs BPX.DAEMON in this particular case.

Ed