Issue starting Portal after upgrading on Fips enabled OS

Products

• Network Observability
• CA Performance Management

Issue/Introduction

After upgrading portal will not start correctly.

An error similar to the following is seen in the <install_dir>/CA/PerformanceCenter/DM/logs/DMService.log:

Caused by: java.lang.UnsatisfiedLinkError: /tmp/bc-fips-jni_xxxxxxxxx/libbc-probe.so: /tmp/bc-fips-xxxxxxxxxx/libbc-probe.so: failed to map segment from shared object
    at jdk.internal.loader.NativeLibraries.load(Native Method) ~[?:?]
    at jdk.internal.loader.NativeLibraries$NativeLibraryImpl.open(Unknown Source) ~[?:?]
    at jdk.internal.loader.NativeLibraries.loadLibrary(Unknown Source) ~[?:?]
    at jdk.internal.loader.NativeLibraries.loadLibrary(Unknown Source) ~[?:?]
    at java.lang.ClassLoader.loadLibrary(Unknown Source) ~[?:?]
    at java.lang.Runtime.load0(Unknown Source) ~[?:?]


The server is configured in FIPS mode.

Environment

Upgrade to Performance Management version 25.4.4

Cause

The /tmp directory is mounted with the noexec option and the server is running in FIPS mode.

Resolution

This issue has been resolved in DX NetOps 25.4.5 and later

Workaround:

In the instructions below replace <service> with the appropriate service (DM,PC,EM,sso) this will need to be done for all four services
Note that the service directory is sso but the variable to look for will be SSO_HOME.

1) Create an alternate temp location for use, such as you may have done already for installation to set IATEMPDIR to/

2) Backup then edit, 

/opt/CA/PerformanceCenter/<service>/conf/wrapper.conf


      Before the set.<service>_HOME=, add:

@include.optional ../conf/wrapper-user.conf

Then in /opt/CA/PerformanceCenter/<service>/conf/wrapper-user.conf, add the following line:

wrapper.java.additional.16=-Djava.io.tmpdir=<new location for tmp from step 1>

3) Restart the services

 

Additional Information

Performance Management 25.4.5 resolved issues

Symptom:
When the /tmp directory is mounted using the noexec
flag, various actions in the NetOps Portal installer or
services fail to run the Bouncy Castle encryption libraries
from the /tmp directory.

Resolution:
With this fix, the NetOps Portal
installer, various tools, and the servicewrapper.conf
file now set up and use the IATEMPDIR
environment variable that the installer uses to bypass the /tmp
directory running in noexec
mode.
(25.4.5, DE181521, 36794725)