Product Documentation
Abstract
Here is a third-party software application that conflicts with the Guardium application.
Content
The following identifies third-party applications that interfere with the installation or running of Guardium and how to work around these conflicts.
TAMOS
(3) TAMOS (Tivoli Access Manager) - Bug 33006, Bug 32286 - Disable TAMOS during a Guardium S-TAP installation. To avoid potential hangs of processes or server, TAMOS and STAP must NOT be run together until ALL of the following conditions are met.
Note: When using TAMOS, turn Storage Keys to OFF when using AIX.
(a) Disable TAMOS (rc.osseal stop).
(b) Make sure to install S-TAP version v9 r46961 or higher. Configure STAP inspection engines.
(c) The TAMOS process must be added to the shmid_blocklist parameter in the STAP guard_tap.ini:
shmid_blocklist=<full path to tamos binary>
For example, shmid_blocklist=/opt/pdos/bin/pdosd
(d) Disable STAP.
(e) Enable TAMOS (rc.osseal start).
(f) Make sure guard_stap process has been made immune in the TAMOS policy:
Use the immunity feature of TAMOS to avoid conflicts between Guardium and TAMOS.
Immunity of Guardium is accomplished by using the Immune-Programs policy by
creating the following policy object:
/OSSEAL/<branch>/TCB/Immune-Programs/usr/local/guardium/guard_stap (customer
may need to change this to reflect actual location of guard_stap binary)
Further information can be found in the TAMOS 6.0 Administration Guide, Chapter on Policy, Subsection Trusted Computing Base resources located at
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.itamos.doc/amos60_admin22.htm?path=5_3_3_4_2#tcbstuff
(g) Any database being monitored by Guardium must also be made immune in the TAMOS policy:
An additional use of TAMOS immunity is required for the database application which Guardium is monitoring. Due to database applications use of child processes the pdosexempt command must be used to make the database application immune to TAMOS.
To make the database application immune to TAMOS, the command
"/usr/bin/pdosexempt -i $$" needs to be inserted at the beginning of the startup script for the database application.
The TAMOS 6.0 Administration Guide, Chapter Commands, Subsection pdosexempt contains a description of the pdosexempt command. The TAMOS 6.0 Administration Guide is located at
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.itamos.doc/amos60_admin124.htm?path=5_3_9_8#pdosexemptcli
(h) Enable STAP.
Was this topic helpful?
Document Information
Modified date:
16 July 2018
UID
swg27042118