Functional Requirement for Workload Automation Agent Spool Directory Permissions
Article ID: 141945
Updated On:
Products
Issue/Introduction
This article explains the functional requirement for drwxrwxrwt permissions on the Workload Automation Agent spool directory. These settings are frequently flagged during security audits or vulnerability (VUL) scans. This configuration is necessary to prevent access-denial issues in multi-user job execution environments where multiple designated users run jobs through the agent.
Environment
Product: CA Workload Automation System Agent
OS: Unix / Linux
Releases: ALL
Cause
When the System Agent runs as the root user and executes jobs on behalf of different owners, the specific job owner must have write and execute access to the spool folder to create and update their individual spool files. If the spool directory is restricted, the job owner will be unable to access the folder, leading to job failures or stuck statuses.
Resolution
The spool folder requires world-writable and executable permissions (777) with the sticky bit (t) enabled.
Technical Justification
- Execute (x): Allows job owners to enter the directory to access their files.
- Write (w): Allows job owners to create new spool files and remove temporary entries.
- Sticky Bit (t): Ensures that even though the directory is world-writable, users can only delete or modify files they personally own. This maintains security in a shared environment.
Implementation
Run the following command to ensure the spool directory is correctly configured:
The resulting permissions should appear as follows:
Managing Individual File Permissions
If security scans flag the permissions of the files created within the spool folder, use the following parameters in agentparm.txt to enforce stricter file-level access:
oscomponent.umask: Defines the default umask for jobs and the agent.oscomponent.defaultfile.permission: Sets the default permissions for files created by the agent (e.g., 640).
Additional Information
For detailed steps on configuring these parameters, see Change the Default Permissions of the Files Created by the Agent.
Feedback
