DWO050E issuing echo command in Netview 6.4 with Top Secret

Products

• Top Secret

Issue/Introduction

After upgrading Tivoli Netview from 6.2 to 6.4, a user is getting a DWO050E error messages when invoking a REXX executable that issues an echo command as part of the Unix command server checkout.

Per IBM Support:
**
DWO050E FOR PROBLEM DEBUG: COMPONENT: PIPE MODULE: DSIPIUNX RC: 7 from xxxxxxx RET66E13031 -0000000013 is an indication of an authorization issue.

"According the " z/OS UNIX System Messages and Codes", the -0000000013 code you see in message DWO050E is documented as follow:
---------
-0000000013 Indicates that an internal error during set user's group (setgid) processing caused UNIX command processing to terminate.
**

TSSUTIL and a security trace on the user don’t show any violations. 

The TSSOERPT output shows:

       SERVICE      USERID    GROUP        UID         GID    SAF     RC    RSN
         DATE          TIME    JOBNAME   SOURCE   SYSID   CPU   SECLABEL

   R_setgid         uuuuuu    gggggg         nnnnnn     nnnn   8      8      8
   mm/dd/yy  yy.ddd    hh.mm.ss xxxxxxxx                   xxxx
   Failed - User not authorized to change GID
    GID To Be Set:          nnn Real GID     :         zzzz
    Effective GID:          zzzz  Saved GID    :        zzzz

Resolution

Top Secret only checks for UID=0 on a SETGID call. So the ACID will need UID(0). Per the IBM documentation, the user ACID of the UNIX command server either needs to be UID(0) or needs to have BPX.SUPERUSER authority. (In Top Secret, this would be IBMFAC(BPX.SUPERUSER).)