getGMAP 8/8:4 In Top Secret TSSOERPT

Products

• Top Secret
• Top Secret - LDAP
• WEB ADMINISTRATOR FOR TOP SECRET

Issue/Introduction

The following USS event shows up in the TSSOERPT:

   Mainframe Security     - USS EVENTS                          - PAGE    1                                                  
                                                                                
      SERVICE      USERID    GROUP        UID         GID    SAF     RC    RSN  
        DATE          TIME    JOBNAME   SOURCE   SYSID   CPU   SECLABEL

getGMAP            xxxx           ggggg           9010        9003   8      8      4 
05/21/20  20.142   11.37.59 xxxxxx                   xxxxx
Failed - GID not defined or group not defined as OpenMVS group               
 GID value:             9010                                                 
 Map name:                   Search by GID, return groupname

Environment

Release : 

Component : Top Secret for z/OS

Resolution

For the 8/8/4 with getGMAP: A USS getGMAP is used to map a GID to a GROUP. In this case, the getGMAP is looking for a GID(9010) and not GID(9003). See below.

Failed - GID not defined or group not defined as OpenMVS group
GID value: 9010
Map name: Search by GID, return groupname
According to the above, there is no GROUP with a GID(9010).

The getUMAP or getGMAP errors seen in the TSSOERPT report are due to a file or directory that has a UID or GID assigned to it, but no user or group ACID associated with the UID or GID exists. When a USS service is invoked to display the UID or GID, a USS getUMAP or getGMAP callable service is invoked to request the associated user or group. If there is no user or group for the UID or GID, the USS getUMAP or getGMAP callable service fails with the 8/8:4 return codes. 

Typically, these events occur when a user (ACID) with a unique user (UID) and group (GID) creates files or directories in USS and subsequently the user's ACID, UID, and GROUP are deleted. Since the USS permission bits retain the UID and GID of the user that created the file or directory and the associated user or group record for that UID or GID no longer exists, the getUMAP or getGMAP call fails with the 8/8:4 return codes.

In this case, the getGMAP is looking for a GID value of 90010 and not GID(9003). getGMAPs with a non-zero RC are not necessarily a problem. A look up was being done by the application and a GROUP with a GID(9010) wasn’t found. This is only be a problem if your application requires a GROUP to be defined with a GID(9010).

To eliminate these events, there are two options:

1) Create a Group ACID for the GID identified in the TSSOERPT report.

2) Change the USS permissions of the files or directories associated with the GID identified in the TSSOERPT report (GID(9003) in the event in the description).