PI54331: Source GDG member transfer ends in BFGRP0036I and not BFGIO0056Ewhen no user sandbox rule exists

APAR status

• Closed as program error.

Error description

• The customer is using fix pack 8.0.0.2 of MFT on z/OS 1.13 with
  an MQ v8 agent queue manager. The agent was recently upgraded
  from FTE 7.0.4 to MFT 8.0.0.2 (PTFs UI28639 and AI45435)
  .
  Normally if a dataset isn't covered by a user sandbox rule, the
  customer would expect to see this error:
    BFGIO0056E: Attempt to read file filename has been denied. The
    file is located outside of the restricted transfer sandbox.
  .
  But it seems if the source file is a GDG member, the transfer
  succeeds with the message:
    BFGRP0036I: The transfer request has successfully completed,
    although no files were transferred.
  .
  Destination GSG datasets files properly receive the BFGIO0056E
  error, as do non-GDG dataset source files.
  The customer reported the issue where transfers with a GDG
  member as the source file alongside user sandboxing restrictions
  resulted in the transfer ending as successful, with no files
  transferred when the GDG member was outside the sandbox. The
  customer noticed this change in behavior from WMQ FTE V7.0.4
  once they updated to WMQ MFT V8.0.0.2. At FTE V7.0.4, if the GDG
  member was located outside of the sandbox, the transfer would
  return as Failed.
  .
  After the change team investigated, a change in behavior was
  introduced by the changes made by APAR PI29476. This APAR fixed
  the issue where the source file in a transfer was interpreted as
  the relative GDG name as the absolute GDG name.
  
  However, this has affected GDG member transfers when user
  sandboxing is enabled. The GDG member is checked against the
  user sandboxing rules and if the member is outside of the user
  sandbox, zero files are transferred and the status if the
  transfer is successful. The transfer status should be Failed.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  The APAR affects user of:
  
  - WebSphere MQ File Transfer Edition V7.0.4.5 onwards
  - IBM MQ Managed File Transfer V8.0.0.2 onwards
  - IBM MQ Managed File Transfer V9.0
  
  who have agents running on z/OS that:
  
  - have been configurd to use either an agent or user sandbox.
  - and act as the source agent for managed transfers that process
  Generation Data Group (GDG) datasets.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When an agent had a user sandbox or agent sandbox configured,
  and attempted to transfer a Generation Data Group (GDG) member
  which was located outside of the specified sandbox, the transfer
  completed as 'Successful, with no files transferred'. As the GDG
  member was located outside of the configured sandbox, the
  transfer was expected to failed.
  

Problem conclusion

• The WebSphere MQ File Transfer Edition product and WebSphere MQ
  Managed File Transfer component have been modified so that when
  a transfer item refers to a Generation Data Group (GDG) member
  outside of the configured sandbox locations, the transfer item
  is marked as 'Failed' with the message message:
  
  BFGIO0056E: Attempt to read file "<data_set>" has been denied.
  The file is located outside of the restricted transfer sandbox.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v7.0       7.0.4.7
  v7.5       7.5.0.8
  v8.0       8.0.0.6
  v9.0 CD    9.0.2
  v9.0 LTS   9.0.0.1
  
  The latest available FTE maintenance can be obtained from
  'Fix List for WebSphere MQ File Transfer Edition 7.0'
  http://www-01.ibm.com/support/docview.wss?uid=swg27015313
  
  The latest available MQ maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ MFT Z/OS

• Fixed component ID

  5655MFT00

Applicable component levels

• R800 PSY

     UP