IJ24864: SECUREMAIN LOCK CAUSES AGENT UPDATE TO HANG

IBM Tivoli Monitoring 6.3.0 Fix Pack 7 Service Pack 5 (6.3.0.7-TIV-ITM-SP0005)

APAR status

• Closed as program error.

Error description

• ITM version: 5608A41CI 6.30.07.00
  When installing the new
  security patch of
  >> 6.3.0-TIV-ITM-FP0007-CVE-2020-4311
  
  agents are not completing their upgrade due to the executed
  command of "securemain.cmd lock" as per the instructions of the
  patch.
  
  Noticed that the change of the permissions on
  CANDLEHOME has caused here also problems for the Logfile Agent
  upgrade.
  
  FINDINGs:
  found out this is due to an extra folder
  under candle_home not having the admin permissions set by
  securemain, so that "securemain lock" causes agent update to
  hang.
  
  Workaround: Run securemain unlock in another window to
  unblock the agent upgrade
  

Local fix

• Workaround: Run securemain unlock in another window to unblock
  the agent upgrade
  

Problem summary

• After using securemain.cmd on a Windows system to restrict
  folder access to the <candle_home> install location,
                       future installs of agents may hang.
  
  
  After using securemain.cmd on a Windows system to restrict
  folder access to the <candle_home> install location,
                           future installs of agents may hang.
  

Problem conclusion

• Additional folders, as created by certain agents or factory
  agents, did not have admin permissions re-applied
                          by securemain.cmd.  These folders would
  remain locked to the admin account and would block updates.
  Several common
                          folders have been added to
  securemain.cmd to prevent this problem.  In addition, the "-d"
  command line argument has
                          been added to allow the user to specify
  additional folders to be given admin rights.
  
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
     | service pack | 6.3.0.7-TIV-ITM-SP0005
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  OMEG DIST INSTA

• Fixed component ID

  5608A41CI

Applicable component levels