IT36067: DB2 BACKUP AND RESTORE CAN FAIL WITH PERMISSION DENIED ON INPUT.JSON FILE

APAR status

• Closed as program error.

Error description

• DB2 backup and restore operation with IBM Spectrum Protect Plus
  can fail with permission denied on input.json file if DB2
  instance owner is not allowed to access this file which is
  owned by SPP agent user. The backup job log shows:
  
  ERROR,1610042373477,<date+time+timezone>,2,,[db2-ip-address]
  Error encountered in the Db2 ACS interface
  ERROR,1610042373477,<date+t
  ime+timezone>,2,,[db2-ip-address] [Errno 13] Permission denied:
  '/tmp/6222cfc3-477d-4ef8-a753-373ca60bb59e/input.json'
  
  The input.json file has a 600 permission for SPP agent user even
  though its umask value is 022, so DB2 instance owner cannot
  access it.
  
  Versions affected: 10.1.*
  

Local fix

• Add "umask = 022" to /etc/security/user file in the default
  section or a separate section for SPP agent user
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  *  IBM Spectrum Protect Plus level 10.1.6 and 10.1.7           *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in the next IBM Spectrum Protect Plus  *
  * level 10.1.8. Note that this is subject to change at the     *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• IBM Spectrum Protect Plus is fixed to perform backup and restore
  in case when sppagent user has different umask values for file
  creation.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels