Setup for z/OSMF on z/OS 2.3 throws off a security error indicating libIzugJni64.so is not PROGRAM CONTROLLED

Question

I am setting up z/OSMF on a z/OS 2.3 system and receiving the following errors after starting IZUSVR1 and attempting to login to z/OSMF for the first time. The errors are seen in the JES Job log and the console log:

BPXP015I HFS PROGRAM /usr/lpp/zosmf/lib/libIzugJni64.so IS NOT MARKED PROGRAM CONTROLLED.
BPXP014I ENVIRONMENT MUST BE CONTROLLED FOR DAEMON (BPX.DAEMON) PROCESSING.

There is nothing in the documentation to indicate a configuration for the dll libIzugJni64.so. I've attempted to set the program control bits as indicated by the message and all other permissions look correct?

Suggestions on how to bypass this issue ?

Answer 1

The error message indicated is not helpful in pointing at the actual problem.

The issue is that the z/OSMF started task IZUSVR1 is running a WebSphere Liberty runtime. WebSphere Liberty is a Java EE runtime and as such requires an adjunct process called an Angel process where authorized services are executed. z/OSMF looks specifically for an Angel process named IZUANG1. The Angel process has a default name and requires a specific override to change it. z/OSMF looks for a specific process called IZUANG1 and this is not the default name.

In order to specify this name you have to modify the Angel Started Task. Here is a snippet of the change I had to make to my process.

Note the NAME=IZUANG1 on the PROC statement and added on the PARM statement on STEP1. My JCL originally did not have this parameter.

//IZUANG1  PROC P='',C=N,ROOT='/usr/lpp/zosmf',OUTCLS='*',          
//   IZUTIME=NOLIMIT,NAME=IZUANG1                                   
//*--------------------------------------------------------------*/ 
//* Startup procedure for the z/OSMF Websphere Liberty Profile   */ 
//* Angel process.                                               */ 
//*--------------------------------------------------------------*/ 
//STEP1   EXEC PGM=BPXBATA2,REGION=0M,                              
//  TIME=&IZUTIME.,                                                 
//  PARM='PGM &ROOT./wlp/lib/native/zos/s390x/bbgzangl COLD=&C &P   
//             NAME=&NAME'                                          

Unfortunately the failure is silent until you attempt to access an authorized service (like logging into z/OSMF for instance). The error messages are also unhelpful in actually identifying the root cause. This should get you past this issue.