I’ve blogged I want to be someone else – or using pthread_security_np, how a server can be passed a userid or password to logon to a server to do some work. For example I was logging on from a web server to the RMF GPMSERVE for displaying RMF reports in a a web browser.
I had followed the documentation, but all my userids had access, when none of them should have done. This blog post covers the steps I used to dig into this.
The RACF calls used, have a flag set “Suppress any RACF Messages”, which makes it harder to diagnose problems.
With most RACF calls you can define a profile
ADDSD 'COLIN.PROT.DATASET' UACC(NONE) WARNING
where the WARNING option says “If the userid does not have access – give the userid access, but write a message on the console”. This allows you to find when you need to grant access. Once the profile is established, you can use the ALTSD … NOWARNING. Userids requesting access, but which are not permitted will now fail.
Defining a profile with CLASS(APPL), the warning has no effect. I had to use NOTIFY(COLIN) to get notified of problems.
Tracing the requests
To trace all of the RACF calls made by my job COLINNT I issued
#set trace(callable(all),racroute(all),jobname(COLINNT))
This gave me many hundreds of calls.
Once I had been through the whole process, I found the trace for the pthread_security_np etc calls was just
set trace(callable(type(38)),jobname(COLINNT))
Collect a trace
See Collecting and understanding a RACF GTF trace output.
Looking at the trace output
There is a trace record “before” (PRE) matching “after” (POST). Many parameters are the same (as you might expect).
The output of these traces is verbose, with unnecessary information and with extra blanks lines. For example for one parameter
Area length: 00000008
Area value:
D6C6C6E2 C5E30000 | OFFSET.. |
Area length: 00000004
Area value:
00000000 | .... |
Area length: 00000008
In the description below, I’ve squashed this down to a single line
area length 8 OFFSET0000 length 4 00000000
It looks like the field OFFSET0000 has the offset in hex from somewhere. I didn’t find this information useful.
A compressed trace record is given below. For the interpretation of the fields see the following trace record.
RTRACE
OMVSPRE
Service number 00000026
Parameters
area length x6c
area length 8 OFFSET0000 length 4 00000000
area length 8 OFFSET0004 length 4 00000000
area length 8 OFFSET0008 length 4 00000000
area length 8 OFFSET000C length 4 00000000
area length 8 OFFSET0010 length 4 40404040
area length 8 OFFSET0014 length 4 00000000
area length 8 OFFSET0018 length 4 40404040
area length 8 OFFSET001C length 1 01
area length 8 OFFSET0020 length 4 C4800000
area length 8 OFFSET0024 length 6 05c1c2c3c4C2 = .ABCDB
area length 8 OFFSET0028 length 4 00000000
area length 8 OFFSET002C length 9 08C7D7D4 E2C5D9E5 C5 = .GPMSERVE
Internal information
area length 8 OFFSET0034 length x37 = "Server Userid=IBMUSER created a full ACEE"
area length 8 OFFSET0048 length 4 00000000
area length 8 OFFSET0050 length 9 08000000 00000000 00
area length 8 OFFSET0054 length 1 00
area length 8 OFFSET0018 length 4 40404040
Internal data
area length xc0 ACEE
area length x50 userid information
area length x90 ACEX
area length x50 USP
hex dump of record
The RACF commands documentation says for a callable service, 0x00000026 is function number for IRRSIA00. This page gives the name of the function name IRRSIA00 and the description z/OS kernel on behalf of servers that use pthread_security_np servers or __login, or MVS servers that do not use z/OS UNIX services.
The parameters are for the initACEE (IRRSIA00) call.
The matching “after” record, OMVSPOST was (with the parameters of the the IRRSIA00 call format, parameters) are
RTRACE
OMVSPOST
Service number: 00000026
RACF Return code: 00000008
RACF Reason code: 00000020
Parameters
area length 8 OFFSET0000 length 4 00000000 >work_area<
area length 8 OFFSET0004 length 4 00000000 >ALET<
area length 8 OFFSET0008 length 4 00000008 >SAF_return_code<
area length 8 OFFSET000C length 4 00000000 >ALET<
area length 8 OFFSET0010 length 4 00000008 >RACF_return_code<
area length 8 OFFSET0014 length 4 00000000 >ALET<
area length 8 OFFSET0018 length 4 00000020 >RACF_reason_code<
area length 8 OFFSET001C length 1 01 >Function_code 1 = Create an ACEE<
area length 8 OFFSET0020 length 4 C4800000 >Attributes - see below<
area length 8 OFFSET0024 length 6 05c1c2c3c4C2 >Userid .ABCDB<
area length 8 OFFSET0028 length 4 00000000 >ACEE_pointer<
area length 8 OFFSET002C length 9 08C7D7D4 E2C5D9E5 C5 >APPLID = .GPMSERVE<
Internal information
area length 8 OFFSET0034 length x37 = "Server Userid=IBMUSER created a full ACEE"
area length 8 OFFSET0048 length 4 00000000
area length 8 OFFSET0050 length 9 08000000 00000000 00
area length 8 OFFSET0054 length 1 00
area length 8 OFFSET0018 length 4 40404040
Internal data
area length xc0 ACEE
area length x50 userid information
area length x90 ACEX
area length x50 USP
There the attributes C480000 mean
- X80000000 – Create the ACEE
- X40000000 – Createthe USP for the userid
- X04000000 – Suppress any RACF Messages
- X00800000 – Return an OUSP in the output area
Note the flag:X04000000 – Suppress any RACF Messages.
The return code
area length 8 OFFSET0008 length 4 00000008 >SAF_return_code<
...
area length 8 OFFSET0010 length 4 00000008 >RACF_return_code<
area length 8 OFFSET0014 length 4 00000000 >ALET<
area length 8 OFFSET0018 length 4 00000020 >RACF_reason_code<
8,8,32 means The user does not have appropriate RACF access to either the SECLABEL, SERVAUTH profile, or APPL specified in the parmlist.
For other RACF services the trace entries follow a similar format.
ColinPaice 