SRM-RIB: Operational Reports Server failure on FIPS-enabled OS due to /tmp noexec

Products

• Network Observability

Issue/Introduction

After upgrading DX NetOps (SRM-RIB) to version 25.4.x on a FIPS-enabled operating system, the Operational Reports Server fails to communicate with the Portal. While the srm-rib service may show as 'active (running)', the following error appears in the /app/local/SRM/srm-rib/logs/OperationalReportsServer.log:

text

Caused by: java.lang.UnsatisfiedLinkError: /tmp/bc-fips-jni_xxxx/libbc-probe.so: failed to map segment from shared object

Environment

• Product: DX NetOps Spectrum / SRM-RIB
• Version: 25.4.x
• OS: FIPS-enabled Linux (RHEL/Oracle Linux)
• Security Configuration: /tmp directory is mounted with the noexec flag.

Cause

The Bouncy Castle FIPS encryption library, used for secure communications, attempts to unpack and execute a native library (libbc-probe.so) in the system's temporary directory. If /tmp is mounted with the noexec flag (a common security hardening measure), the operating system prevents the library from loading, causing the application context to fail initialization.

Resolution

Option 1: Redirect JVM Temporary Directory (Recommended)

Redirect the Java temporary directory to a location that allows execution. This avoids changing global system security policies.

1. Create a new temporary directory (ensure the path is outside the restricted /tmp partition):

   bash

   mkdir -p /opt/SRM/srm-rib/tmp
   chmod 777 /opt/SRM/srm-rib/tmp

2. Edit the configuration file: Open /opt/SRM/srm-rib/conf/srm-rib-jetty.conf for editing.

3. Add the JVM argument: Locate the section for additional Java arguments and add the following line (use the next available index if JAVA_ADDITIONAL_2 is taken):

   plaintext

   JAVA_ADDITIONAL_2=-Djava.io.tmpdir=/opt/SRM/srm-rib/tmp

4. Restart the service:

   bash

   systemctl restart srm-rib

Option 2: Remount /tmp with Execution Permissions

If corporate policy allows, remount the /tmp partition to allow execution temporarily or permanently in /etc/fstab:

bash

mount -o remount,exec /tmp
systemctl restart srm-rib