PH62266: IBM DEVELOPER FOR Z V16.0.5 - ACCESS SECURITY CHECK FAILS FOR JES SPOOL FILES ROUTED FROM OTHER SYSTEMS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• In zExpl 3.3 JESSPOOL Access security check fails for JES spool
  files routed from another system when the execution node is
  defined as NODE on the local system.
  
  Users Affected:
  Users who display JES spool files routed from other systems.
  
  Workaround:
  NA
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: 1. Users who display JES spool files         *
  *                 routed from other systems.                   *
  *                 2. All users                                 *
  *                 3. All users                                 *
  *                 4. All users                                 *
  *                 5. security admin                            *
  *                 6. All users who manage files and folders    *
  *                 via RSE UNIX support                         *
  *                 7. IBM support                               *
  *                 8. IBM support                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: 1. Access security check fails for      *
  *                      JES spool files routed from other       *
  *                      systems.                                *
  *                      2. Currently, zRSE host does not        *
  *                      update PDS member's ISPF STATS if it    *
  *                      is not ON (mode is turned off or the    *
  *                      STATS is deleted) or it is validated    *
  *                      as invalid.                             *
  *                      Customer is requested that IDz/zRSE     *
  *                      to turn on and set the ISPF STATS of    *
  *                      the PDS member when is edited and       *
  *                      saved if it is not already on.          *
  *                      3. When perform consecutive             *
  *                      "Data set member" for RSE or            *
  *                      "PDSMembers searches with filter        *
  *                      memberName regex options, each has      *
  *                      its own different regex memberName      *
  *                      options setting, if they are executed   *
  *                      close enough (between 10sec from the    *
  *                      first search), the result of the        *
  *                      subsequent searches may incorrectly     *
  *                      returns with the result from the        *
  *                      first search.                           *
  *                      RSEAPI also treats memberName regex     *
  *                      as case insensitive, causing            *
  *                      incorrect query match.                  *
  *                      4. In zExplore 3.3.4, GFL               *
  *                      (Generic Filter Locate) search on       *
  *                      datasets with large catalog entry can   *
  *                      lead to high CPU consumption.           *
  *                      This was seen on z/OS Explorer 3.3.4    *
  *                      RSU UI95993, and expected existing in   *
  *                      earlier versions.                       *
  *                      5. FEKRACF has invalid option ALL for   *
  *                      the LISTGRP command                     *
  *                      6. When using RSE to delete a           *
  *                      symbolic link to a directory, the       *
  *                      files and folders under that            *
  *                      directory are deleted instead of just   *
  *                      the symbolic link                       *
  *                      7. invalid FEKLOGS warning for          *
  *                      NLSPATH and RSE_PLUGIN_PATH             *
  *                      8. FEKLOGS enhancement to report on     *
  *                      extended attributes                     *
  ****************************************************************
  1. JESSPOOL Access security check fails for JES spool files
  routed from another system when the execution node is defined
  as NODE on the local system and you are not the owner of the
  spool file.
  2. The ISPF STATS mode can be turned on outside of IDz/zRSE by
  using ISPF, but it is trouble some for users as they have to
  switch back and forth between the application to achieve that.
  It is preferred to have zRSE host to be able to turn on and
  set the stats automatically when it is not on.
  3. RSE backends keeps a cache of key query to improve the
  performance, the key value construction does not count the
  regex memberName pattern. When the cache is not expired
  (within 10 sec from the last cache added), the search may
  return the cache of the last search matching the filter only,
  not the memberName regex pattern.
  Regex pattern match is case sensitive.
  4. It is due to the work area provided in the CSI query does
  not meet the minimum required size in the resume CSI query.
  Error code 40-0 would be shown in the residual catalog trace
  data.
  5. FEKRACF has invalid option ALL for the LISTGRP command in
  the dataset security section
  6. When using RSE to delete a symbolic link to a directory,
  the files and folders under that directory are deleted instead
  of just the symbolic link
  7. invalid FEKLOGS warning for NLSPATH and RSE_PLUGIN_PATH
  8. FEKLOGS enhancement to report on extended attributes
  

Problem conclusion

• 1. JMON now correctly constructs the profile name covering the
  spool file.
  2. A new host boolean environment RSE_AUTO_ISPF_STATS_SAVE
  (default to FALSE) to turn on the auto ISPF STATS option when
  a PDS member is edited and saved.
  This option is applied on all connections to the zRSE server.
  A more flexible tailored to the need per connection could be
  considered in the future as needed.
  3. RSE backend now construct a search cache's key to include
  the memberName pattern in a regex member search.
  RSEAPI also treats memberName pattern as case sensitive in
  regex-member search.
  4. RSE now would adjust the work area size to the minimum
  required size if it is smaller.
  The upper bound of the size increment could be customized by
  the server environment RSE_MAX_CSI_WORK_AREA_SIZE, default to
  262144 (byte).
  5. ALL option is removed
  6. When deleting a symbolic link to a directory, only the
  symbolic link to the directory should be deleted.
  7. feklogs fixed, plus update to validate ssl.properties
  enable_attls_policy
  8. FEKLOGS enhancement to report on extended attributes
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI99118

Modules/Macros

• FEJENF70 FEJJCNFG FEJJJCL  FEJJMON  FEJTSO   FEK1SMPE FEK2RCVE
  FEK3ALOC FEK4ZFS  FEK5MKD  FEK6DDEF FEK7APLY FEK8ACPT FEK@CERR
  FEK@CONE FEK@CONF FEK@CUST FEK@DEB  FEK@DESC FEK@FLOW FEK@GEN
  FEK@GENW FEK@ISPF FEK@IVP  FEK@IVPD FEK@IVPW FEK@JCN1 FEK@JCNE
  FEK@JESJ FEK@MAIN FEK@MIGO FEK@OPTE FEK@OPTG FEK@OPTN FEK@PRIM
  FEK@RSE1 FEK@RSEO FEK@STRT FEK@TAB1 FEK@TAB2 FEK@TAB3 FEK@WRK1
  FEK@WRK2 FEK@WRK3 FEK@WRK4 FEK@WRK5 FEKAPPCC FEKAPPCL FEKAPPCX
  FEKATTR  FEKDSI   FEKEESX0 FEKFASIZ FEKFATT1 FEKFBLD  FEKFCIPH
  FEKFCLIE FEKFCMOD FEKFCMPR FEKFCMSG FEKFCOMM FEKFCOPY FEKFCOR6
  FEKFCORE FEKFDBG  FEKFDBG6 FEKFDBGM FEKFDIR  FEKFDIR6 FEKFDIVP
  FEKFDST0 FEKFDST1 FEKFDST2 FEKFENVF FEKFENVI FEKFENVP FEKFENVR
  FEKFENVS FEKFEPL  FEKFERRF FEKFGDGE FEKFICUL FEKFISPF FEKFIVP0
  FEKFIVPA FEKFIVPD FEKFIVPI FEKFIVPJ FEKFIVPT FEKFJESM FEKFJESU
  FEKFJLIC FEKFJSON FEKFJVM  FEKFLATR FEKFLDSI FEKFLDSL FEKFLEOP
  FEKFLOGS FEKFLPTH FEKFMAI6 FEKFMAIN FEKFMINE FEKFMNTL FEKFNTCE
  FEKFOMVS FEKFPATT FEKFPKCS FEKFPLUG FEKFPTC  FEKFRIVP FEKFRMSG
  FEKFRSES FEKFRSRV FEKFSCMD FEKFSEND FEKFSSL  FEKFSTUP FEKFT000
  FEKFT002 FEKFT003 FEKFT004 FEKFT005 FEKFT006 FEKFT007 FEKFT008
  FEKFT009 FEKFTEAM FEKFTIVP FEKFTSO  FEKFUTIL FEKFVERS FEKFXITA
  FEKFXITL FEKFZOS  FEKHCONF FEKHCUST FEKHDEB  FEKHDESC FEKHFLOW
  FEKHGEN  FEKHISPF FEKHIVP  FEKHIVPD FEKHJESJ FEKHMAIN FEKHMIGO
  FEKHOPTE FEKHOPTN FEKHPRIM FEKHRSE1 FEKHRSEO FEKHSTRT FEKHTAB1
  FEKHTAB2 FEKINIT  FEKKEYS  FEKLOCKA FEKLOGR  FEKLOGS  FEKM00
  FEKM01   FEKM02   FEKMKDIR FEKMOUNT FEKMSGC  FEKMSGS  FEKPKCS1
  FEKRACF  FEKRSED  FEKSAPF  FEKSAPPL FEKSBPX  FEKSCLAS FEKSCLOG
  FEKSCMD  FEKSCPYM FEKSCPYU FEKSDSN  FEKSENV  FEKSETUP FEKSISPF
  FEKSJCFG FEKSJCMD FEKSJMON FEKSJWT  FEKSJWTU FEKSLPA  FEKSPROG
  FEKSPTKT FEKSRSED FEKSSERV FEKSSTC  FEKSSU   FEKSUSER FEKXCFGE
  FEKXCFGI FEKXCFGM FEKXCFGT FEKXMAIN FEKXML   HUHFCOR6 HUHFCORE
  

Fix information

• Fixed component name

  EXP FOR Z/OS HO

• Fixed component ID

  5655EXP23

Applicable component levels

• R330 PSY UI99118

     UP24/11/22 P F411

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.