PI57974: OSGi applications may be able to get access to OSGi services pro vided by Liberty feature bundles which are not considered API.

8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• An OSGi application may contain bundles that register and
  use OSGi services with an objectClass contained in an API
  package.  For example, javax.servlet.Servlet.  The Liberty
  runtime may also contain bundles that register OSGi services
  using the same objectClass.  Under certain circumstances it
  is possible for the OSGi application to get access to the
  OSGi services registered by Liberty runtime feature bundles
  whose objectClasses are from API packages but the services
  themselves are not considered APIs.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty Profile                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: OSGi applications may be able to get    *
  *                      access to OSGi services provided by     *
  *                      Liberty feature bundles which are not   *
  *                      considered API.                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  An OSGi application may contain bundles that register and use
  OSGi services with an objectClass contained in an API package.
  For example, javax.servlet.Servlet.  The Liberty runtime may
  also contain bundles that register OSGi services using the same
  objectClass.  Under certain circumstances it is possible for the
  OSGi application to get access to the OSGi services registered
  by Liberty runtime feature bundles whose objectClasses are from
  API packages but the services themselves are not considered
  APIs.
  

Problem conclusion

• The Liberty feature header IBM-API-Service is used to specify
  which services are to be considered API services for use by OSGi
  applications.  In past releases this header did not strictly
  enforce access to service registrations.  Now this header is
  used to strictly enforce which services an OSGi application has
  access to at runtime.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 8.5.5.9.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

• None.  Applications may be accessing OSGi services that are not
  considered API services.  With this fix applications will no
  longer be able to access OSGi services that are not considered
  API services.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels

• R855 PSY

     UP