Re: Domain Violations error on *QTPCS

Needles,Stephen J wrote:
> We have recently noted a program (RPG/SQL with Lansa calls) that
> has been encountering an Authority Failure on an object called
> *QTPCS.  It runs from within a QRWTSRVR (DRDA) job.  It does not
> happen every time the program is run, it is intermittent.  So
> far, we have not found any indication that this is happening from
> the program's job logs.  We are getting the info from a security
> report from the OS (which is V6R1).
> 
> The Journal Entry for these occurrences indicates that it is a
> domain violation.
> 
> What is the nature of a Domain Violation?
> 
> Can the denial of access to this Temporary Process Control Space
> (*QTPCS) cause the program's failure?  It doesn't appear that the
> Err Sev is high enough.  But this program has had some recently
> troubling behavior.
> 
> Any ideas/answers?
> 

   A domain violation correspond with the LIC exception identifier 
x/4401 which is the message identifier MCH6801.  The condition is 
signaled and a failure is only effected [with that message being 
sent] when the QSECURITY is greater than 30.  No information can be 
inferred for what the unnamed program does without a joblog and\or 
trace showing the message; remains unknown if the exception is 
signaled, or that the program merely encounters the condition for 
its violation which is only logged as the domain violation [an AF-D 
I believe] in the QUADJRN auditing.  The program is performing an 
operation that breaks security\integrity rules, either purposely or 
accidentally; in either case, that would be suspect for problems.

   See "2.2.2 System Object Access Control" in document GG244200 
about a program running in *USER state that attempts to access an 
object in the *SYS domain:
http://www.redbooks.ibm.com/redbooks/pdfs/gg244200.pdf

Regards, Chuck
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.