IBM Support

PI47248: PERMISSION ERRORS ACCESSING RESOURCES IN THE SERVER'S WORKAREA DIRECTORY USING APPLICATION SYNCTOOSTHREAD WITH JSP INCLUDE TAG

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • There are permission errors when using SyncToOSThread
    accessing
    resources in the server's workarea directory under the
    unauthenticate userid (ie. WSGUEST) for jsps that contain a
    jsp
    include tag.
    
    An example tag may look like:
    
    
    
    An example of the permission failure in SYSLOG and Liberty
    Job
    output is as follows.
    
    ICH408I USER(WSGUEST ) GROUP(WSCLGP  ) NAME(WAS DEFAULT USER
    )
    /SYSTEM/etc/liberty/servers/server1/workarea/org.eclipse.osg
    i
    /bundles/58/data/cacheAdapt/com.ibm.ws.app.manager_42/UserAp
    plic
    ation.war/.overlay/UserFile.jsp
    CL(DIRSRCH ) FID(01D7D9E5F0F0F000032A00000F6E0000)
    INSUFFICIENT AUTHORITY TO LSTAT
    ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
    EFFECTIVE UID(0000002402)  EFFECTIVE GID(0000002502)
    
    Where WSGUEST is the unauthenticated userid.
    
    Setting a slip on the ICH408I
    
    SLIP SET,MSGID=ICH408I,
    A=SVCD,ML=1,ASIDLST=(H,P,S),JOBNAME=,
    SDATA=(ALLNUC,PSA,CSA,LPA,TRT,SQA,RGN,GRSQ,SUM,WLM,SWA),END
    
    and formatting out the stacktrace shows:
    
    java/io/UnixFileSystem.getBooleanAttributes0
    java/io/UnixFileSystem.getBooleanAttributes
    java/io/File.exists
    com/ibm/wsspi/kernel/service/utils/FileUtils$3.run
    com/ibm/wsspi/kernel/service/utils/FileUtils$3.run
    java/security/AccessController.doPrivileged
    com/ibm/wsspi/kernel/service/utils/FileUtils.fileExists
    com.ibm.wsspi.artifact.ArtifactEntry
    com/ibm/ws/artifact/file/internal/FileContainer.getEntry
    com.ibm.wsspi.artifact.ArtifactEntry
    com/ibm/ws/artifact/file/internal/FileContainer.getEntry
    com/ibm/ws/artifact/overlay/internal/DirectoryBasedOverlayCo
    ntai
    nerImpl$
    OverlayDelegatingEntry.getLastModified()
    com/ibm/ws/adaptable/module/internal/AdaptableEntryImpl.getL
    astM
    odified
    com/ibm/ws/jsp/inputsource/JspInputSourceContainerImpl
    com.ibm.wsspi.jsp.resource.JspInputSource
    com/ibm/ws/jsp/inputsource/JspInputSourceFactoryImpl.createJ
    spIn
    putSource
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionServletWr
    appe
    r.initialize
    com.ibm.wsspi.webcontainer.servlet.IServletWrapper
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionProcessor
    .cre
    ateServletWrapper
    com.ibm.wsspi.webcontainer.servlet.IServletWrapper
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionProcessor
    .fin
    dWrapper
    com.ibm.wsspi.webcontainer.servlet.IServletWrapper
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionProcessor
    .get
    ServletWrapper
    com/ibm/ws/webcontainer/filter/WebAppFilterManager.invokeFil
    ters
    com/ibm/ws/webcontainer/webapp/WebAppRequestDispatcher.dispa
    tch
    com/ibm/ws/webcontainer/webapp/WebAppRequestDispatcher.inclu
    de
    org/apache/jasper/runtime/JspRuntimeLibrary.include
    com/ibm/_jsp/_admhome._jspService
    com/ibm/ws/jsp/runtime/HttpJspBase.service
    javax/servlet/http/HttpServlet.service
    com/ibm/ws/webcontainer/servlet/ServletWrapper.service
    com/ibm/ws/webcontainer/servlet/ServletWrapper.handleRequest
    com/ibm/ws/webcontainer/servlet/ServletWrapper.handleRequest
    com/ibm/wsspi/webcontainer/servlet/GenericServletWrapper.han
    dleR
    equest
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionServletWr
    appe
    r.handleRequest
    com/ibm/ws/webcontainer/filter/WebAppFilterManager.invokeFil
    ters
    com/ibm/ws/webcontainer/webapp/WebApp.handleRequest(
    com/ibm/ws/webcontainer/osgi/DynamicVirtualHost$2.handleRequ
    est(
    com/ibm/ws/webcontainer/WebContainer.handleRequest
    com/ibm/ws/webcontainer/osgi/DynamicVirtualHost$2.run()
    com/ibm/ws/http/dispatcher/internal/channel/HttpDispatcherLi
    nk$T
    askWrapper.run()
    java/util/concurrent/ThreadPoolExecutor.runWorker
    java/util/concurrent/ThreadPoolExecutor$Worker.run()
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server Liberty Profile for z/OS             *
    ****************************************************************
    * PROBLEM DESCRIPTION: Permission errors while the server      *
    *                      tries to access a file in its workarea  *
    *                      when configured to use syncToOSThread   *
    *                      and JSPs.                               *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    Permission errors are seen during a request to a JSP that uses
    the jsp:include tag.
    During request processing the server attempts to access a file
    in its workarea directory. The identity used to access the file
    is the unauthenticated user identity of WSGUEST as opposed to
    the server's identity. This happens when the syncToOSThread
    support is enabled.
    
    The following permission errors are seen in the logs:
    
    ICH408I USER(WSGUEST ) GROUP(WSCLGP  ) NAME(WAS DEFAULT USER
    ) /SYSTEM/etc/liberty/servers/server1/workarea/org.eclipse.osgi
    /bundles/58/data/cacheAdapt/com.ibm.ws.app.manager_42/UserApplic
    ation.war/.overlay/UserFile.jsp
    CL(DIRSRCH ) FID(01D7D9E5F0F0F000032A00000F6E0000)
    INSUFFICIENT AUTHORITY TO LSTAT
    ACCESS INTENT(--X)  ACCESS ALLOWED(OTHER      ---)
    EFFECTIVE UID(0000002402)  EFFECTIVE GID(0000002502)
    
    Setting a slip on the ICH408I
    
    SLIP SET,MSGID=ICH408I,
    A=SVCD,ML=1,ASIDLST=(H,P,S),JOBNAME=<jobname>,
    SDATA=(ALLNUC,PSA,CSA,LPA,TRT,SQA,RGN,GRSQ,SUM,WLM,SWA),END
    
    and formatting out the stacktrace shows:
    
    java/io/UnixFileSystem.getBooleanAttributes0
    java/io/UnixFileSystem.getBooleanAttributes
    java/io/File.exists
    com/ibm/wsspi/kernel/service/utils/FileUtils$3.run
    com/ibm/wsspi/kernel/service/utils/FileUtils$3.run
    java/security/AccessController.doPrivileged
    com/ibm/wsspi/kernel/service/utils/FileUtils.fileExists
    com.ibm.wsspi.artifact.ArtifactEntry
    com/ibm/ws/artifact/file/internal/FileContainer.getEntry
    com.ibm.wsspi.artifact.ArtifactEntry
    com/ibm/ws/artifact/file/internal/FileContainer.getEntry
    com/ibm/ws/artifact/overlay/internal/DirectoryBasedOverlayContai
    nerImpl$
    OverlayDelegatingEntry.getLastModified()
    com/ibm/ws/adaptable/module/internal/AdaptableEntryImpl.getLastM
    odified
    com/ibm/ws/jsp/inputsource/JspInputSourceContainerImpl
    com.ibm.wsspi.jsp.resource.JspInputSource
    com/ibm/ws/jsp/inputsource/JspInputSourceFactoryImpl.createJspIn
    putSource
    com/ibm/ws/jsp/webcontainerext/AbstractJSPExtensionServletWrappe
    r.initialize
    ...
    com/ibm/ws/webcontainer/webapp/WebApp.handleRequest(
    com/ibm/ws/webcontainer/osgi/DynamicVirtualHost$2.handleRequest(
    com/ibm/ws/webcontainer/WebContainer.handleRequest
    com/ibm/ws/webcontainer/osgi/DynamicVirtualHost$2.run()
    com/ibm/ws/http/dispatcher/internal/channel/HttpDispatcherLink$T
    askWrapper.run()
    java/util/concurrent/ThreadPoolExecutor.runWorker
    java/util/concurrent/ThreadPoolExecutor$Worker.run()
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    PI47248

  • Reported component name

    LIBERTY PROF -

  • Reported component ID

    5655W6514

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2015-08-20

  • Closed date

    2015-09-29

  • Last modified date

    2015-09-29

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    LIBERTY PROF -

  • Fixed component ID

    5655W6514

Applicable component levels

  • R850 PSY

       UP

[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"850","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
29 September 2015