PM10729: RACF VIOLATION FOR UPDATE INTENT ON SORTWORK DATASETS RESULTING IN S913 ABEND.

APAR status

• Closed as program error.

Error description

• RACF violation for update intent on SORTWORK datasets resulting
  in S913 abend. SORTWORK datasets are statically defined in the
  sort procedure
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of DRF who have a protect-all      *
  *                 environment or who have the TEMPDSN class    *
  *                 active.                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: In a protect-all environment, when DRF  *
  *                      initiates a new started task, the       *
  *                      initial userid associated with the      *
  *                      started task comes from the RACF        *
  *                      STARTED class table.  Once DRF code     *
  *                      executes, it creates a new userid       *
  *                      matching the userid which submitted     *
  *                      the DRF master job and associates it    *
  *                      with the started task.  However, if     *
  *                      the started task does not have READ     *
  *                      access to the data sets in the          *
  *                      //STEPLIB DD statement then job may     *
  *                      abend with ABENDS913 with insufficient  *
  *                      access.                                 *
  *                                                              *
  *                      Also, when the RACF TEMPDSN class is    *
  *                      active, and SORTWORK DD statements are  *
  *                      coded in the JCL, temporary data sets   *
  *                      are created for these data sets.  DRF   *
  *                      then propagates the userid from the     *
  *                      DRF master job into the sort address    *
  *                      space job, switching the userid used    *
  *                      for authority.  When the TEMPDSN class  *
  *                      is active, this causes RACF security    *
  *                      errors (ICH408I message) against the    *
  *                      temporary data sets associated with     *
  *                      the SORTWORK files.  This is because    *
  *                      with TEMPDSN active, only the userid    *
  *                      which created the data sets has         *
  *                      authority to update them.               *
  ****************************************************************
  * RECOMMENDATION: INSTALL CORRECTIVE SERVICE FOR APAR/PTF      *
  ****************************************************************
  In a protect-all environment or when the TEMPDSN class is
  active, DRF subordinate address spaces may experience security
  errors and message ICH408I or ABENDS913
  

Problem conclusion

• GEN:
  KEYWORDS:
  
  *** END IMS KEYWORDS ***
  DRF has been enhanced to add a new keyword which will allow the
  customer to turn off the userid propagation feature.  By
  default, DRF will propagate the userid associated with the DRF
  master job to all subordinate address spaces which allow them
  to execute with the same level of authority as the original
  job.
  
  In cases where problems are encountered with the TEMPDSN class
  or other reasons in which this propagation causes problems, you
  can use the new USERPROP() keyword to disable userid
  propagation.
  
  The User's Guide and Reference of IMS Database Recovery
  Facility SC18-9407-04, will need to be modified as following:
  
  
  Chapter 3. Configuring the product environment in batch mode
  
  The documentation for the OPTION(<subparameters>) parameter
  needs to be modified to add USERPROP(Y | N) as a new
  subparameter.
  
  USERPROP(YES | Y | NO | N)
   Specifies whether the userid that is associated with the DRF
   master job is propagated to the subordinate address spaces
   which are directly started by DRF.  These address spaces
   include the Recovery Sort Subordinate (RSS) address space,
   the IMS Index Builder (IB-UAS) address space, and the
   DFSPREC0 utility (PR-UAS) address space.  Userid propagation
   allows the subordinate address space to execute with the same
   level of security as the DRF master job, eliminating the need
   for special entries in the RACF STARTED class.
  
   The default, if this paramater is not specified is YES which
   means userid propagation is performed.
  
   This parameter is useful in cases where the TEMPDSN class is
   active and you need to hard code the SORTWORK DD statements
   in the DRFPROC() procedure.
  
  
  Chapter 15. IMS Database Recovery Facility messages
  
  
  FRD1009I USERID userid PROPAGATED FROM DRF MASTER JOB
  
  Explanation:  Userid propagation processing is in effect and
  this message indicates that the userid that was used to submit
  the DRF master job was propagated to this subordinate address
  space.  This means that this addres space will execute with the
  same level of authority as the DRF master job.  This process is
  controlled by the OPTION(USERPROP()) keyword.
  
  userid Identifies the userid which was associated with the DRF
         master job and has been propagated to this subordinate
         address space
  
  System action: Processing continues.
  
  User response: None.
  
  Module: FRXSDR20, FRXICTL0
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK56222

Modules/Macros

• FRXBDMG0 FRXEDRF  FRXEDRF0 FRXEPSS0 FRXEWSP
  FRXICTL0 FRXLBLD0 FRXRVGB  FRXRWSP  FRXSASP  FRXSDR00 FRXSDR20
  FRXTAU00 FRXUTGB  FRXVWSP
  

Fix information

• Fixed component name

  IMS DB RECOVERY

• Fixed component ID

  5655I4400

Applicable component levels

• R310 PSY UK56222

     UP10/04/22 P F004