PK33335: MESSAGE EYUCR0008E IS NOT PRODUCED WHEN DFHSIT PARM XCMD=YES IS CODED FOR CMAS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Customer is starting a CMAS with the SEC=YES and XCMD=YES CICS
  DFHSIT parameters and SEC(YES) as a CICSPlex SM system parameter
  (EYUPARM). Documentation, within the CICS TS V3.1  Installation
  Guide and the CICSPlex SM Messages and Codes, indicates XCMD,
  XDCT, XFCT, XJCT,XPCT, and XPPT must all be defined as NO if the
  CICSPlex SM system parameter SEC(YES) is coded. Documentation
  indicates message EYUCR0008E will be issued and the CMAS will
  terminate if this restriction is not followed. Yet, this does
  not appear to be enforced.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICSPlex SM V3R1M0 Users.                *
  ****************************************************************
  * PROBLEM DESCRIPTION: - Message EYUCR0008E:                   *
  *                                                              *
  *                        'Mutually exclusive CICS and CICSplex *
  *                        SM security parameters specified.     *
  *                        The CMAS will terminate.'             *
  *                                                              *
  *                        is not issued when a CMAS is started  *
  *                        with the CICS SIT option SEC=YES and  *
  *                        the XFCT, XJCT, XDCT, XPPT, XPCT,     *
  *                        XDB2 and XCMD options are not all set *
  *                        to NO.                                *
  *                                                              *
  *                      - Message EYUCR0009I may be issued      *
  *                        with invalid ESMResponse and          *
  *                        ESMReason values when SECLOGMSG is    *
  *                        set to YES or ALL. For example:       *
  *                                                              *
  *                        'Security check: Userid=USERA,        *
  *                        Class=CCICSCMD, Access=Read,          *
  *                        Resource=STATISTICS,                  *
  *                        ESMResponse=1077952576,               *
  *                        ESMReason=1077952576'                 *
  *                                                              *
  *                        The incorrect inserts will typically  *
  *                        be issued for a simulated command     *
  *                        security check involving multiple     *
  *                        resources.                            *
  ****************************************************************
  * RECOMMENDATION: After applying the PTF that resolves this    *
  *                 APAR, all CMASes must be recycled to pick    *
  *                 up the new code.  Note that the restarts     *
  *                 do not need to be done at the same time.     *
  ****************************************************************
  - CICSPlex SM Security operates independently from CICS
    Security.  As part of CICSPlex SM simulated security, CICSPlex
    SM must issue a RACROUTE REQUEST=LIST (RACLIST) in the CMAS
    for security classes used by the MASes. As the CMAS CICS could
    also have issued a similar command for the same classes, the
    CICSPlex SM request could fail.
  
    To prevent this error, EYU0CRIN attempts to check the security
    classes specified in the CICS SIT (XFCT, XJCT, XDCT, XPPT,
    XPCT, XDB2 and XCMD options) to insure that they are all set
    to no to avoid the potential conflict. EYU0CRIN contains
    invalid offsets for checking these values, so the SIT check is
    never correctly processed.
  
  - When a simulated command security check is required for the
    CICSRGN object, a list of command security resource names are
    built and passed to the CICSPlex SM security processor. When
    the first resource name fails, the remaining resource names
    are not checked. If SECLOGMSG processing is active, The
    EYUCR0009I message can contain invalid ESMResponse and
    ESMReason inserts because no return codes have ever been set
    for the unprocessed resource names.
  

Problem conclusion

• - The restriction requiring XFCT, XJCT, XDCT, XPPT, XPCT, XDB2
    and XCMD to be set to NO when SEC is set to YES in the SIT
    options for a CMAS has been removed.
  
    To allow this change, the following changes have been made:
  
    - EYU0CRIN will no longer check the CMAS X... security related
      SIT options.
    - EYU9XSEC has been changed to determine if a RACROUTE
      REQUEST=LIST has failed due to the class already being
      RACLISTed.  During shutdown, EYU9XSEC will only attempt to
      delete RACLISTed classes that it successfully issued the
      RACLIST for.
    - EYU0CRLT has been changed to maintain the security class
      related flags now set by EYU9XSEC.  Additionally, new
      message EYUCR0010I:
  
        'Security profiles not refreshed.  Refresh must be
        performed using ESM.'
  
      has been added. This message will be issued by EYU0CRLT when
      the CMAS or CMASLIST SECREBUILD actions are issued as a
      reminder that the command has no effect and that the ESM
      should be used to refresh the profiles. For RACF, the TSO
      command would be 'SETR RACLIST(nnnnnnnn) REFRESH' - where
      nnnnnnnn is the RACF classname to be refreshed.
  
  - EYU0CRCK has been changed so that if the ESMResponse and
    ESMReason values are set to spaces (which means the security
    check was not performed), then message EYUCR0009I is not
    issued.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

• - Message EYUCR0008E:
  
    'Mutually exclusive CICS and CICSplex
    SM security parameters specified.
    The CMAS will terminate.'
  
    is not issued when a CMAS is started
    with the CICS SIT option SEC=YES and
    the XFCT, XJCT, XDCT, XPPT, XPCT,
    XDB2 and XCMD options are not all set
    to NO.
  
  - Message EYUCR0009I may be issued
    with invalid ESMResponse and ESMReason
    values when SECLOGMSG is set to YES or
    ALL. For example:
  
    'Security check: Userid=USERA,
    Class=CCICSCMD, Access=Read,
    Resource=STATISTICS,
    ESMResponse=1077952576,
    ESMReason=1077952576'
  
    The incorrect inserts will typically
    be issued for a simulated command
    security check involving multiple
    resources.
  
  - CICSPlex SM Security operates independently from CICS
    Security.  As part of CICSPlex SM simulated security, CICSPlex
    SM must issue a RACROUTE REQUEST=LIST (RACLIST) in the CMAS
    for security classes used by the MASes. As the CMAS CICS could
    also have issued a similar command for the same classes, the
    CICSPlex SM request could fail.
  
    To prevent this error, EYU0CRIN attempts to check the security
    classes specified in the CICS SIT (XFCT, XJCT, XDCT, XPPT,
    XPCT, XDB2 and XCMD options) to insure that they are all set
    to no to avoid the potential conflict. EYU0CRIN contains
    invalid offsets for checking these values, so the SIT check is
    never correctly processed.
  
  - When a simulated command security check is required for the
    CICSRGN object, a list of command security resource names are
    built and passed to the CICSPlex SM security processor. When
    the first resource name fails, the remaining resource names
    are not checked. If SECLOGMSG processing is active, The
    EYUCR0009I message can contain invalid ESMResponse and
    ESMReason inserts because no return codes have ever been set
    for the unprocessed resource names.
  
  - The restriction requiring XFCT, XJCT, XDCT, XPPT, XPCT, XDB2
    and XCMD to be set to NO when SEC is set to YES in the SIT
    options for a CMAS has been removed.
  
    To allow this change, the following changes have been made:
  
    - EYU0CRIN will no longer check the CMAS X... security related
      SIT options.
    - EYU9XSEC has been changed to determine if a RACROUTE
      REQUEST =LIST has failed due to the class already being
      RACLISTed.  During shutdown, EYU9XSEC will only attempt to
      delete RACLISTed classes that it successfully issued the
      RACLIST for.
    - EYU0CRLT has been changed to maintain the security class
      related flags now set by EYU9XSEC.  Additionally, new
      message EYUCR0010I:
  
        'Security profiles not refreshed.  Refresh must be
        performed using ESM.'
  
      has been added. This message will be issued by EYU0CRLT when
      the CMAS or CMASLIST SECREBUILD actions are issued as a
      reminder that the command has no effect and that the ESM
      should be used to refresh the profiles. For RACF, the TSO
      command would be 'SETR RACLIST(nnnnnnnn) REFRESH' - where
      nnnnnnnn is the RACF classname to be refreshed.
  
  - EYU0CRCK has been changed so that if the ESMResponse and
    ESMReason values are set to spaces (which means the security
    check was not performed), then message EYUCR0009I is not
    issued.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK19858

Modules/Macros

•    EYUBCRCL EYUBCRRR EYUTCMM0 EYUUCMEQ EYU0CRCK
  EYU0CRDK EYU0CRIN EYU0CRLT EYU0CRSI EYU9XSEC EYU9XSTC
  

Fix information

• Fixed component name

  CPSM CICS 3.1

• Fixed component ID

  5655M1501

Applicable component levels

• R100 PSY UK19858

     UP06/11/22 P F611

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.