IBM(R) Tivoli(R) Access Manager for Operating Systems, 
Patch 6.0.0-TIV-PDO-FP0013 README
=============================================================================

(C) Copyright International Business Machines Corporation 2008. All rights
reserved. U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

Created/Revised by  Date of Creation/Update  Summary of Changes
------------------  -----------------------  ------------------
GFM                 June 28, 2008            Document Created
GFM                 July 2, 2008             Notice to not install 
                                             6.0.0-TIV-PDO-AIX-FP0013.tar.Z
GFM                 July 29, 2008            Remove not to not install
                                             AIX version of patch.
-----------------------------------------------------------------------------

  CONTENTS

  1.0 ABOUT THIS PATCH
      1.1 Patch contents
      1.2 Architectures
      1.3 Patches superseded
      1.4 Dependencies

  2.0 APARS AND DEFECTS FIXED
      2.1 Problems fixed by patch 6.0.0-TIV-PDO-FP0001
      2.2 Problems fixed by patch 6.0.0-TIV-PDO-FP0003
      2.3 Problems fixed by patch 6.0.0-TIV-PDO-FP0005
      2.4 Problems fixed by patch 6.0.0-TIV-PDO-FP0006
      2.5 Problems fixed by patch 6.0.0-TIV-PDO-FP0007
      2.6 Problems fixed by patch 6.0.0-TIV-PDO-FP0009
      2.7 Problems fixed by patch 6.0.0-TIV-PDO-FP0010
      2.8 Problems fixed by patch 6.0.0-TIV-PDO-FP0012
      2.9 Problems fixed by patch 6.0.0-TIV-PDO-FP0013

  3.0 BEFORE INSTALLING THIS PATCH
      3.1 Back up Tivoli Access Manager for Operating Systems data

  4.0 INSTALLING THIS PATCH
      4.1 Installing this patch on AIX systems
      4.2 Installing this patch on HP-UX systems
      4.3 Installing this patch on Linux systems
      4.4 Installing this patch on Solaris Operating Environment systems

  5.0 UNINSTALLING THIS PATCH

  6.0 AFTER INSTALLING THIS PATCH
      6.1 Verifying patch level

  7.0 DOCUMENTATION UPDATES
      7.1 Clarification of prerequisite TOUR pkg for HP-UX 
          (HP PRE-REQS ARE NOT AVAILABLE FROM HP (IY83216))
      7.2 Release Notes Correction for Solaris Prereqs
      7.3 Support and limitations for AIX 6.1 in fixpack 
          6.0.0-TIV-PDO-FP0010 and above.
      7.4 Support and limitations for RHEL 5 in fixpack 
          6.0.0-TIV-PDO-FP0012 and above.
      7.5 Certified Applications.
      7.6 Considerations when running on HACMP for AIX systems

  8.0 SOFTWARE LIMITATIONS
      8.1 Virtualized Operating System Environments
      8.2 Linux kernel driver support

  9.0 KNOWN PROBLEMS AND WORKAROUNDS
      9.1 SLES10/SLED10 Support Issues
      9.2 HP-UX Kernel Driver loading issue
      9.3 RHEL 5 Support Issues
      9.4 Secure Shell (SSH) Authentication Key Usage
      9.5 Do Not Load TAMOS STREAMS module
      9.6 TAMOS 6.0 and TAMeb 6.1

  10.0 NOTICES
       10.1 Trademarks

*****************************************************************************
*****************************************************************************

1.0 ABOUT THIS PATCH
--------------------

  This patch package contains fixes for problems in Tivoli Access Manager
  for Operating Systems (TAMOS) software. This patch requires that IBM 
  Tivoli Access Manager for Operating Systems, Version 6.0 already be 
  installed successfully.  

1.1 Patch contents

  This patch package contains:
    - This README file
    - Update patch packaging for TAMOS

1.2 Architectures

  This patch package applies to the following architectures:
  ________________________________________________________________________ 

  Note: Tivoli Access Manager components for AIX are supported on
  32-bit and 64-bit kernels in 32-bit compatibility mode.

  AIX 5.1 - AIX maintenance package 5100, Level 7 or higher
          - xlC.rte (6.0.0.0 C Set ++ Runtime
          - xlC.aix50.rte (6.0.0.3 or higher C Set ++ Runtime)

  AIX 5.2 - AIX maintenance package 5200, Level 5 or higher
          - xlC.rte (6.0.0.0 C Set ++ Runtime)
          - xlC.aix50.rte (6.0.0.3 or higher C Set ++ Runtime)
          - bos.rte.libc (5.2.0.12 or higher)

  AIX 5.3 - AIX Maintenance package 5300, Level 1 or higher
          - xlC.rte (6.0.0.0 C Set ++ Runtime)
          - xlC.aix50.rte (6.0.0.3 or higher C Set ++ Runtime)
          - APAR IY69685
          - APAR IY69766

  AIX 6.1  No specific patches at this time
  ________________________________________________________________________ 

  HP-UX 11iv1 The following patches are required for HP-UX.
              For some patches, the order is important, and some
              patches will require a reboot of the system:
              - Bundle 11i (B.11.11.0306.1)
              - GOLDBASE11i quality pack December 2004
              - GOLDAPPS11i qualify pack December 2004
              - GOLDQPK11i_11.11.depot
              - PHNE_27796
              - PHNE_28895
              - Current Transport Optional Upgrade Release (TOUR) 
                package found on the HP Website:
                http://h20293.www2.hp.com/cgi-bin/swdepot_parser.cgi/
                       cgi/displayProductInfo.pl?productNumber=TOUR
                *** Note:  See section 7.1 of this README for more details.
              - PHCO_24400
	      - PHCO_24402
              - PHNE_25084

              1) For these four files, first install GOLDQPK11i_11.11.depot.
              2) Then use the script inside PHNE_27796_28895.depot.tar to 
                 create a depot for those two patches.
              3) Finally, install the current TOUR package which will
                 rebuild the kernel and will reboot the system.

              For Global Security Kit (GSKit):
              - PHKL_30288
              - PHKL_30542
              - PHNE_29887
              - PHCO_29960
              - PHSS_30970 (for GSKit)

              For the HP-UX mount command
              -  PHCO_25841
              -  PHKL_26269
              -  PHKL_32035

  HP-UX 11iv2  No specific patches at this time
  ________________________________________________________________________ 

  Solaris 8  - 108528-29 
             - 108991
             - 108993-31
             - 111023-03
             - 111317-05
             - 111327-05
             - 113648-03
             - 115827-01
             - 116602-01

             For the 32-bit kernel:
             - 108434-14

             For the 64-bit kernel:
             - 108435-14

  Solaris 9  For the 32-bit kernel:
             - 111711-08

             For the 64-bit kernel:
             - 111712-08

  Solaris 10 No specific patches at this time
  ________________________________________________________________________ 

  Linux for AMD64 and EM64T

  TAMOS supports only specific Linux AMD64 and EM64T kernel drivers 
  explicitly listed in this section.

  Red Hat Enterprise Linux Server 4.0
    - Update 1 update kernels
        kernel-2.6.9-11.EL.x86_64.rpm
        kernel-smp-2.6.9-11.EL.x86_64.rpm
    - Update 2 update kernels 
        kernel-2.6.9-22.EL.x86_64.rpm
        kernel-smp-2.6.9-22.EL.x86_64.rpm
    - Update 3 update kernels
        kernel-2.6.9-34.EL.x86_64.rpm
        kernel-smp-2.6.9-34.EL.x86_64.rpm
    - Update 4 update kernels
        kernel-2.6.9-42.EL.x86_64.rpm
        kernel-smp-2.6.9-42.EL.x86_64.rpm
    - Update 5 update kernels
        kernel-2.6.9-55.EL.x86_64.rpm
        kernel-smp-2.6.9-55.EL.x86_64.rpm

  Red Hat Enterprise Linux Server 5.0
    - Update 1 update kernels
        kernel-2.6.18-8.1.1.el5.x86_64.rpm

  SUSE LINUX Enterprise Server 9
    - Kernel levels after Linux installation
        kernel-default-2.6.5-7.97.x86_64.rpm
        kernel-smp-2.6.5-7.97.x86_64.rpm
    - Service Pack 3 update kernels
        kernel-default-2.6.5-7.244.x86_64.rpm
        kernel-smp-2.6.5-7.244.x86_64.rpm

  Novell Linux Desktop 9
    - Service Pack 2 update kernels
        kernel-default-2.6.5-7.191.x86_64.rpm
        kernel-smp-2.6.5-7.191.x86_64.rpm
    - Service Pack 3 update kernels
        kernel-default-2.6.5-7.244.x86_64.rpm
        kernel-smp-2.6.5-7.244.x86_64.rpm

  SUSE LINUX Enterprise Server 10 
     - Kernel levels after Linux installation
        kernel-default-2.6.16.21-0.8.x86_64.rpm
        kernel-smp-2.6.16.21-0.8.x86_64.rpm
  ________________________________________________________________________ 

  Linux for POWER, iSeries, and pSeries 

  TAMOS supports only specific Linux POWER, iSeries and pSeries kernel 
  drivers explicitly listed in this section.

  Red Hat Enterprise Linux Server 3.0
    - Kernel levels after Linux installation
        kernel-2.4.21-4.EL.ppc64iseries.rpm
        kernel-2.4.21-4.EL.ppc64pseries.rpm
    - Update 6 update kernels
        kernel-2.4.21-37.EL.ppc64iseries.rpm
        kernel-2.4.21-37.EL.ppc64pseries.rpm
    - Update 7 update kernels
        kernel-2.4.21-40.EL.ppc64iseries.rpm
        kernel-2.4.21-40.EL.ppc64pseries.rpm
    - Update 8 update kernels
        kernel-2.4.21-47.EL.ppc64iseries.rpm
        kernel-2.4.21-47.EL.ppc64pseries.rpm

  Red Hat Enterprise Linux Server 4.0
    - Update 1 update kernels
        kernel-2.6.9-11.EL.ppc64iseries.rpm
        kernel-2.6.9-11.EL.ppc64.rpm
    - Update 2 update kernels
        kernel-2.6.9-22.EL.ppc64iseries.rpm
        kernel-2.6.9-22.EL.ppc64.rpm
    - Update 3 update kernels
        kernel-2.6.9-34.EL.ppc64iseries.rpm
        kernel-2.6.9-34.EL.ppc64.rpm
    - Update 4 update kernels
        kernel-2.6.9-42.EL.ppc64iseries.rpm
        kernel-2.6.9-42.EL.ppc64.rpm

  Red Hat Enterprise Linux Server 5.0
    - Update 1 update kernels
        kernel-2.6.18-8.1.1.el5.ppc64iseries.rpm
        kernel-2.6.18-8.1.1.el5.ppc64.rpm

  United Linux 1.0
    - Kernel levels after Linux installation
        kernel-iseries64-2.4.19-104.ppc.rpm
        kernel-ppc64-2.4.19-108.ppc.rpm
    - Service Pack 4 update kernels
        kernel-iseries64-2.4.21-278.ppc.rpm
        kernel-ppc64-2.4.21-278.ppc.rpm

  SUSE LINUX Enterprise Server 9
    - Kernel levels after Linux installation
        kernel-iseries64-2.6.5-7.97.ppc.rpm
        kernel-pseries64-2.6.5-7.97.ppc.rpm
    - Service Pack 3 update kernels
        kernel-iseries64-2.6.5-7.244.ppc.rpm
        kernel-pseries64-2.6.5-7.244.ppc.rpm

  SUSE LINUX Enterprise Server 10 
    - Kernel levels after Linux installation
        kernel-iseries64-2.6.16.21-0.8.ppc.rpm
        kernel-ppc64-2.6.16.21-0.8.ppc.rpm
  ________________________________________________________________________ 

  Linux for S/390 and zSeries

  TAMOS supports only specific Linux S/390 and zSeries kernel drivers 
  explicitly listed in this section.

  Red Hat Enterprise Linux Server 3.0
    - Kernel levels after Linux installation
        31-bit: kernel-2.4.21-4.EL.s390.rpm 
        64-bit: None
    - Update 6 update kernels
        31-bit: kernel-2.4.21-37.EL.s390.rpm
        64-bit: kernel-2.4.21-37.EL.s390x.rpm
    - Update 7 update kernels
        31-bit: kernel-2.4.21-40.EL.s390.rpm
        64-bit: kernel-2.4.21-40.EL.s390x.rpm
    - Update 8 update kernels
        31-bit: kernel-2.4.21-47.EL.s390.rpm
        64-bit: kernel-2.4.21-47.EL.s390x.rpm

  Red Hat Enterprise Linux Server 4.0
    - Update 1 update kernels
        31-bit: kernel-2.6.9-11.EL.s390.rpm
        64-bit: kernel-2.6.9-11.EL.s390x.rpm
    - Update 2 update kernels
        31-bit: kernel-2.6.9-22.EL.s390.rpm
        64-bit: kernel-2.6.9-22.EL.s390x.rpm
    - Update 3 update kernels
        31-bit: kernel-2.6.9-34.EL.s390.rpm
        64-bit: kernel-2.6.9-34.EL.s390x.rpm
    - Update 4 update kernels
        31-bit: kernel-2.6.9-42.EL.s390.rpm
        64-bit: kernel-2.6.9-42.EL.s390x.rpm

  Red Hat Enterprise Linux Server 5.0
    - Update 1 update kernels
        31-bit: kernel-2.6.18-8.1.3.el5.s390.rpm
        64-bit: kernel-2.6.18-8.1.3.el5.s390x.rpm

  United Linux 1.0
    - Kernel levels after Linux installation
        31-bit: k_deflt-2.4.19-32.s390.rpm
        64-bit: k_deflt-2.4.19-34.s390x.rpm
    - Service Pack 4 update kernels
        31-bit: k_deflt-2.4.21-278.s390.rpm
        64-bit: k_deflt-2.4.21-278.s390x.rpm

  SUSE LINUX Enterprise Server 9
    - Kernel levels after Linux installation
        31-bit: kernel-s390-2.6.5-7.97.s390.rpm
        64-bit: kernel-s390x-2.6.5-7.97.s390x.rpm
    - Service Pack 3 update kernels
        31-bit: kernel-s390-2.6.5-7.244.s390.rpm
        64-bit: kernel-s390x-2.6.5-7.244.s390x.rpm
    - U.S. Daylight Saving Time 2007 Date Change
        31-bit: kernel-s390-2.6.5-7.282.s390.rpm
        64-bit: kernel-s390x-2.6.5-7.282.s390x.rpm

  SUSE LINUX Enterprise Server 10 
    - Kernel levels after Linux installation
        31-bit: None
        64-bit: kernel-default-2.6.16.21-0.8.s390x.rpm
  ________________________________________________________________________ 

  Linux for x86

  TAMOS supports only specific Linux x86 kernel drivers explicitly 
  listed in this section.

  Red Hat Enterprise Linux Server 3.0
    - Kernel levels after Linux installation
        kernel-2.4.21-4.EL.i686.rpm
        kernel-smp-2.4.21-4.EL.i686.rpm
    - Update 5 update kernels
        kernel-2.4.21-32.EL.i686.rpm
        kernel-smp-2.4.21-32.EL.i686.rpm
    - Update 6 update kernels
        kernel-2.4.21-37.EL.i686.rpm
        kernel-smp-2.4.21-37.EL.i686.rpm
    - Update 7 update kernels
        kernel-2.4.21-40.EL.i686.rpm
        kernel-smp-2.4.21-40.EL.i686.rpm
    - Update 8 update kernels
        kernel-2.4.21-47.EL.i686.rpm
        kernel-smp-2.4.21-47.EL.i686.rpm

  Red Hat Enterprise Linux Server 4.0
    - Update 1 update kernels
        kernel-2.6.9-11.EL.i686.rpm
        kernel-smp-2.6.9-11.EL.i686.rpm
    - Update 2 update kernels
        kernel-2.6.9-22.EL.i686.rpm
        kernel-smp-2.6.9-22.EL.i686.rpm
    - Update 3 update kernels
        kernel-2.6.9-34.EL.i686.rpm
        kernel-smp-2.6.9-34.EL.i686.rpm
    - Update 4 update kernels
        kernel-2.6.9-42.EL.i686.rpm
        kernel-smp-2.6.9-42.EL.i686.rpm
    - Update 5 update kernels
        kernel-2.6.9-55.EL.rpm
        kernel-smp-2.6.9-55.EL.rpm

  Red Hat Enterprise Linux Server 5.0
    - Update 1 update kernels
        kernel-2.6.18-8.1.1.el5.rpm

  SUSE LINUX Desktop 1.0
    - Kernel levels after Linux installation
        k_deflt-2.4.19-306.i586.rpm
        k_smp-2.4.19-306.i586.rpm
    - Update kernels
        k_deflt-2.4.19-383.i586.rpm
        k_smp-2.4.19-383.i586.rpm

  Novell Linux Desktop 9
    - Kernel levels after Linux installation
        kernel-default-2.6.5-7.111.i586.rpm
        kernel-smp-2.6.5-7.111.i586.rpm
    - Service Pack 3 update kernels
        kernel-default-2.6.5-7.244.i586.rpm
        kernel-smp-2.6.5-7.244.i586.rpm

  United Linux 1.0
    Required patch:  
    libstdc++-3.2.2-5.i586.rpm from Service Pack 2a (or later)

    - Kernel levels after Linux installation
        k_deflt-2.4.19-120.i586.rpm
        k_smp-2.4.19-113.i586.rpm
          - Service Pack 4 update kernels
        k_deflt-2.4.21-278.i586.rpm
        k_smp-2.4.21-278.i586.rpm

  SUSE LINUX Enterprise Server 9
    - Kernel levels after Linux installation
        kernel-default-2.6.5-7.97.i586.rpm
        kernel-smp-2.6.5-7.97.i586.rpm
          - Service Pack 3 update kernels
        kernel-default-2.6.5-7.244.i586.rpm
        kernel-smp-2.6.5-7.244.i586.rpm
 
  SUSE LINUX Enterprise Server 10 
    - Kernel levels after Linux installation
        kernel-default-2.6.16.21-0.8.i586.rpm
        kernel-smp-2.6.16.21-0.8.i586.rpm
  ________________________________________________________________________ 

1.3 Patches superseded

  Patches superseded by this patch:

    All previous TAMOS 6.0 fixpacks released.  

    All TAMOS fixpacks are cumulative.  Installation TAMOS 6.0 
    Gold Release is required to apply this fixpack.  This fixpack can 
    be installed over any prior TAMOS 6.0 fixpack.

1.4 Dependencies

  IBM Tivoli Access Manager for Operating Systems, Version 6.0

2.0 APARS AND DEFECTS FIXED
---------------------------

 Because patches are cumulative, this patch corrects all the problems
 outlined in the following sections.

2.1 Problems fixed by patch 6.0.0-TIV-PDO-FP0001

  Internal Defect 70671	
  Symptom: Performance enhancement of net output code

  Internal Defect 71194
  Symptom: User-level audit loginpermit does not work

  Internal Defect 71514
  Symptom: Remove use of strptime()in pdoslrd

  Internal Defect 72086
  Symptom: Linux SLES9/RHEL4: umount, mount not forcing file upate in cache

  APAR IY77779
  Symptom: On system that has Login-MaxFailedLogin policy defined and a user 
           logs into the system using a login program that reprompts for a 
           password, the user can enter more incorrect passwords than the 
           MaxFailedLogin policy allows.  It is recommended that login user 
           exception policy is written for these user IDs that are used for 
           rapid automated logins.  Set the Login-MaxFailedLogin to "0". 

  APAR IY80870 
  Symptom: When pdossudo encounters long argument list, 512 arguments 
           or greater, pdossudo terminates with  an error message.

  APAR IY83273
  Symptom: Solaris only.  When transferring large files (over 100MB?), 
           to a solaris system, file corruption can occur.

  APAR IY84508
  Symptom: If policy is defined on a symbolic link and policy is also defined
           on the actual file system object, both policies will be evaluated.
           Policy on parent objects will also be evaluated in this case.  The 
           actual file system object should be the only policy evaluated.

  APAR IY85751 
  Symptom: AIX only.  Blank lines above usernames containing numbers are 
           being removed when login policy is configured.

  APAR IY87208
  Symptom: Linux SLES9/NLD9/RHEL4 only.  When doing trace_exec auditing, the
           arguments for the file getting executed are not showing up in the
           audit record.

  APAR IY87809
  Symptom: If a program listed under Immune-Programs in the TCB calls an exec
           of itself, the resulting program will not be immune.

  APAR IY88654
  Symptom: When a user defines Access-Restrictions with the Traverse "T"
           permission before the [OSSEAL] action group, a memory leak can 
           occur.  The daemon pdosd will continue to grow larger over time.

2.2 Problems fixed by patch 6.0.0-TIV-PDO-FP0003

  APAR IY85237
  Symptom: Some applications may fail to start when TAMOS is running.  There 
	   will be errors in the /var/pdos/log/msg__kosserrs.log referencing 
	   nct_copyPath and aix_shmat failures.

  APAR IY87811  
  Symptom: Applications may fail to attach shared memory segments and/or 
           system calls may fail with an error of EFAULT.  The problem was 
           reproduced running the db2ldif command on a system running TAM 
           server, DB2, IDS Server (LDAP) and TAMOS.  Other applications may 
           exhibit the same behavior.

  APAR IY88727  
  Symptom: With TAMOS login policy enabled and AIX 5.3 ML4 and IY80049 or AIX
	   5.3 ML, the system will not allow users to log in.   The fix is to 
           add "options=authonly" to the methods.cfg file in the PDOS stanzas.  

  APAR IY89673  
  Symptom: Solaris only.  Application hangs in the TAMOS kernel streams 
           module, with a stack similar to the following:

	   genunix:cv_wait+0x38 
	   kazntli:ncttli_close+0x70 
	   genunix:qdetach+0x90 
	   genunix:strclose+0x3c8 
	   sockfs:sock_close+0xf8 
	   genunix:closef+0x58 
	   genunix:closeandsetf+0x384 
	   genunix:close+0x8 
	   kazndrv:nct_close32+0x34 
	   unix:syscall_trap32+0xa8 

  APAR IY89743  
  Symptom: HPUX Only. The TAMOS daemons (pdosd, pdoslpmd, pdosauditd) can 
           core due to interaction with the LDAP-UX Client.  The problem was 
           caused by an LDAP-UX defect (fixed in v4).  The TAMOS daemons did 
           not define enough stack space when using the UNIX getpw*/getgr* 
           functions. A work around is to allow a larger stack size.  Since 
           larger stacks mean more memory consumption, this APAR is going to 
           be enabled by default.  

           Contact TAMOS L2 support for instructions about how to enable larger 
           process stack size for HPUX.  

  APAR IY89939  
  Symptom: HPUX only.  Some programs will not run while TAMOS is running.  The 
           affected programs can be determined with the chatr command.  

	   # chatr  <filename>
	   look for the following lines:
	   third quadrant private data space enabled
	   fourth quadrant private data space disabled

	   If chatr displays the above output, the program is affected and 
	   this APAR will address the problem.

	   If the fourth quadrant private data space is enabled the program 
	   will not execute if TAMOS is running, even with this APAR applied.  
	   To make the program work properly with TAMOS running, either
	   1) make the program immune in the TCB 
	   or
	   2) modify the program with the chatr command:

	      # chatr +q4p disable filename

	   Note that changing the program with chatr will change the amount 
	   of memory available to the program.

  APAR IY90906  
  Symptom: Solaris only.  System will hang with processes unable to fork, 
	   waiting on a condition variable in  If 32 calls could fail, the 
           result is a deadlock in the TAMOS kernel module code.

  APAR IY90960
  Symptom: The permit_audit_actions and permit_deny actions extended 
           attributes are ignored when auditing a defined resource.  This 
           function is discussed in the TAMOS Administrator Guide, Chapter 7, 
           page 199.  The permit_audit_actions and permit_deny_actions do not 
           work as documented.

2.3 Problems fixed by patch 6.0.0-TIV-PDO-FP0005

  APAR IY92583
  Symptom: Audit tracing for a user still occurs after the AuditTrace object 
	   for this user has been deleted.  such as:  
	   "object delete  /OSSEAL/<branchName>/AuditTrace/User/<userName>/all"

  APAR IY93441 (CMVC defect 74696)
  Symptom: HPUX only.  System crash due to recursive call.  Occurs when a 64 
	   bit application detaches a shared memory segment using the shmdt
	   system call.  The stack output looks similar to the following:

	   panic+0x8c
	   _mp_b_sema_sleep+0x1bc
	   _b_sema_adaptive_wait+0x20
	   b_sema_adaptive_wait+0x20
	   procSearch+0x70
	   kenv_procCheckShmat+0x34
	   nct_shmdt32+0x9c
	   pal_shmdt+0x3c
	   kenv_procCheckShmat+0x90
	   nct_shmdt32+0x9c
	   syscall+0x544
	   syscallinit+0x55c

2.4 Problems fixed by patch 6.0.0-TIV-PDO-FP0006

  APAR IY90153
  Symptom: Solaris only. Mounting of automounted directories can be
	   mounted from the same thread.  When this automounted directory 
	   starts to mount, it can hang. 

  APAR IY90284
  Documentation: Solaris only. This fixpack's README corrects the TAMOS
                 6.0 Release notes Solaris prerequisites list.

  APAR IY90381
  Symptom: System crash with stack similar to the following:

	   Stack from AIX:
	   CPU 0 CSA F0000000303A7780 at time of crash, error code for 
	   LEDs: 700

	   pvthread+046500 STACK:
	   kazn51.ext:pal_unpinMem+000020
	   kazn51.ext:kenv_pathMemFini+00041C
	   kazn51.ext:kazn_syscall+000A28 
	   kazn51.ext:kosseal_syscall+000110
	   kazn51.ext:kazn_aixSyscall32+000068
	   .svc_instr+0000FC 

	   Multiple copies of pdosd was running concurrently.  One copy of 
	   pdosd was dumping core.  Due to a disk problem, pdosd was 
	   terminating abnormally and being restarted by the watchdog 
	   repetitively. Unpinned  memory had been freed by another thread 
	   that called kazn_pathMemFini.  A lock has been added to ensure 
	   that only one pdosd process can initialize and destroy the path 
	   memory at one time. 

	   This APAR was found on AIX.  This problem could occur on other 
	   platforms.

  APAR IY92281
  Symptom: The sigsend system call returns error 11 (EPERM) if AMOS 
           kernel drivers are loaded and AMOS is not running.

  APAR IY92719 (Sysroute of IY76317)
  Symptom: The pdoslradm command does not process all audit records in
           batch mode and completion action is set to delete.  This problem 
           occurs when pdoslradm -b is executed frequently.

  APAR IY92748
  Symptom: HPUX only. When using ssh, file descriptors remain open for 
	   TAMOS created files called /var/pdos/lpm/<processID>, where 
	   <processID> is the PID. For example:  /var/pdos/lpm/48576.

  APAR IY92750
  Symptom: HPUX only.  When a network file system mount takes a long time 
	   to respond and the kossd daemon can become defunct.

  APAR IY93558
  Symptom: AIX only. Native file permission of the /etc/security/user 
	   file change after unconfigure and reconfigure of TAMOS

2.5 Problems fixed by patch 6.0.0-TIV-PDO-FP0007

  APAR IY93386
  Symptom: The pdosd daemon created a core file during replication of
           the policy database.
           Analysis of the core file shows the following stack:

           Segmentation fault in wc_net_service_free at 0x1006488c ($t41)
           0x1006488c (wc_net_service_free+0x98) 90040004 stw r0,0x4(r4)

  APAR IY94497
  Symptom: HPUX 11.23 (11iv2) only.  The HPUX kernel cannot be rebuilt if
           TAMOS kernel has been loaded.

  APAR IY95481
  Symptom: Solaris only. Processes may hang on Solaris in a socket close, with 
           a stack (from the kernel debugger) similar to the following:

	   genunix:cv_timedwait+0x98
	   kazndrv:pal_condTimedWait+0x74
	   kazntli:ncttli_close+0x88
	   genunix:qdetach+0x90
	   genunix:strclose+0x3c8
	   sockfs:sock_close+0xf8
	   genunix:closef+0x58
	   genunix:closeandsetf+0x384
	   genunix:close+0x8
	   kazndrv:nct_close32+0x34
	   unix:syscall_trap32+0xa8

  APAR IY96647
  Symptom: Slow performance with a large number of similar messages
           in the output of the kossdump.sh script or the kazntrace utility: 

           "Requester (18) one of 95 waiters for none, 36 waits". 

           Truss on slowly running processes will show numerous open() function 
           calls.

2.6 Problems fixed by patch 6.0.0-TIV-PDO-FP0009

  APAR IY97890
  Symptom: HPUX only. When starting TAMOS, the TAMOS kernel driver loads if not
	   previously loaded. TAMOS makes /dev/kazndrv device and TAMOS gets 
           the major number from the loading of the kernel module. TAMOS was 
           then stopped and HP kernel updates were applied. When the machine 
           is rebooted, the /dev/kazndrv device still exists with the original 
           major number. The new module is assigned to the major number that 
           kazndrv has previously used. TAMOS PAM module attempts to access 
           /dev/kazndrv, which is pointing to the wrong major number. This 
           situation may cause a system crash.

  APAR IY99408
  Symptom: AIX only. The pdoslpmd daemon leaks file descriptors when an 
           unknown/undefined user attempts to login.  (e.g. user mistypes a 
           username, or user tries to guess a username)  This problem to 
           occurs only if TAMOS auditing is turned on.

	   Eventually, pdoslpmd may stop operating due to too many files open.  
	   Messages similar to the following will be written to the 
	   msg__pdoslpmd.log file:

	   2007-05-02-22:16:47.141+00:00I----- 0x35A6268C pdoslpmd ERROR oss db
	   file_lock.c 131 0x00000809 AOSSS1676E   Could not open the lock file 
	   /var/pdos/umsg/pdosd_ctrl.lock: Too many open files: 24

  APAR IY99814
  Symptom: Two Policy definitions are setup on the same executable.  One in 
           the TCB, another in File policy.  The File policy contains a 
           wildcard.  Although a restrictive ACL is attached to the object 
           defining File policy, the action is permitted.

	   example:
	   pdadmin> object create \
	   /OSSEAL/branch/TCB/Secure-Programs/usr/bin/test-su "" 1 i yes
	   pdadmin> object create \ 
	   /OSSEAL/branch/File/usr/*/test-su "" 1 i yes
	   pdadmin> acl create deny-user
	   pdadmin> acl modify deny-user set user testusr1 T[OSSEAL]lr
	   pdadmin> acl modify deny-user set any-other T[OSSEAL]lrx
	   pdadmin> acl attach /OSSEAL/branch/File/usr/*/test-su deny-user

  Internal Defect 76842
  Symptom: Added support for SLES9 U.S. Daylight Savings Time 2007 Date 
           Change (2.6.5-7.282 kernel).  See support list in section 1.2 of 
           this README.

  Internal Defect 77558
  Symptom: Added support for RHEL4 Update 5 (2.6.9-5 kernel).  See support 
           list in section 1.2 of this README.

2.7 Problems fixed by patch 6.0.0-TIV-PDO-FP0010

  APAR IZ06356
  Symptom: pdoscfg fails configuration when gskit 7.0.4.11 is installed.  
           PD.RTE shipped with TAM 6.0.0-TIV-TAM-FP0009 requires installation 
           of gskit 7.0.4.11.  pdoscfg uses gsk7icmd to verify the certificate 
           lifetime.  The pdoscfg command calls /opt/pdos/sbin/cert_test.sh.  
           cert_test.sh calls gsk7icmd. The output format for gsk7icmd has 
           changed. pdoscfg now checks for the old and new output format of 
           gsk7icmd

  APAR IZ06531
  Symptom: SuSE Linux on s390x 64-bit only.   When the TAMOS kernel driver is 
           initializing on an s390x system with more than 2GB of memory, the 
           kernel driver will not load or will generate a segmentation fault 
           core. 

  APAR IZ07737
  Symptom: System Crash in kpcFileEpochNotify.

           The following stack is from AIX.  On other platforms (Solaris, 
           HPUX), the stack will look similiar, but not the same. Look for 
           kpcFileEpochNotify() calling kt_Event3().  The stack will look 
           similiar to the following:

	   strlen+000024 ()                                     
	   kt_AppendRecord+000100        
	   kt_Event3+000028
	   kazn_kpcFileEpochNotify+000108
	   kazn_kpcCommitPolicyEpoch+000074
	   kazn_syscall+0003B0
	   kosseal_syscall+000110
	   kazn_aixSyscall32+000068
	   .svc_instr+000110 

  APAR IZ07926
  Symptom: The pdosd daemon produced a core file.  A segmentation fault  
           occurred in the  wc_net_protocol_free() function. 

	   Using a core debug program, such as dbx on AIX, the error stack will 
	   look similar to the following:
	     wc_net_protocol_free()                              
	     wc_net_outgoing_protocol_free_nolock()
	     wildcard_add_net_outgoing()                       
	     process_net_entry()
	     sendto_kpcapi()                                    
	     kpcmgrOnUpdate()                                                                                     
  APAR IZ11246 (Internal defect 79674)
  Symptom: TAMOS 6.0 support for AIX 6.1

           TAMOS 6.0, with fixpack 6.0.0-TIV-PDO-FP0010 and above, supports 
           AIX 6.1 with limitations.  TAMOS is not supported on AIX 6.1 
           systems using Workspace Partitions (WPARs).

  APAR IZ11255 (Internal defect 79730)
  Symptom: cert_test.sh will fail in some instances: when using active 
           directory or when ldap ssl is configured on a non-default port 
           (not 636).  The cert_test.sh script can receive added options for 
           the ldapsearch command using one of the following methods:
           - Define an LDAPARGS shell variable (e.g. export LDAPARGS="-p 1234")
           or
           - Define a file /opt/pdos/etc/.cert_test_args which has shell 
             variable assignment to LDAPARGS.  The .cert_test_args file will 
             be sourced into the cert_test.sh.

           If the LDAPARGS variable is a defined shell variable, the 
           .cert_test_args file is ignored.

2.8 Problems fixed by patch 6.0.0-TIV-PDO-FP0012

  APAR IZ03897 
  Symptom: HPUX, Solaris and AIX: During high network utilization, the 
           STREAMS system would cause the system to appear sluggish and/or 
           core dumps would show that panics within streams code or 
           ncttli_service() due to an invalid control block (CBP), managed 
           by TAMOS. The control block became invalid when an associated 
           close was allowed to complete, and free the CBP, before the 
           ncttli_service() routine was finished with the CBP. On Solaris 
           and AIX, the result is poor performance followed by a possible 
           system crash. On HPUX, the result is poor performance.

  APAR IZ09423
  Symptom: After a period of time a system can hang. Heavily loaded systems 
           with many CPUs are most vulnerable. On analysis of a forced dump 
           from the hung system, many processes will be blocked in the TAMOS 
           kazndrv kernel module. The will be waiting for a free shared memory 
           slot used to communicate with pdosd. They will be waiting on the 
           freeCond kenv_memState condition variable and will be blocked even 
           though there is a single free shared memory slot.

  APAR IZ09626
  Symptom: Unexpected shmdt() error in 64bit application running on AIX using
           32bit kernel. The error indicated the shared memory segment is 
           already detached.  When the first shmdt() is made by a 64bit 
           application TAMOS traps the shmdt and detaches TAMOS' shared memory 
           segment. aix_shmat() is called but only the lower 32bit address is 
           passed back to the OS. The overwritten upper 32bits remain.

  APAR IZ13940
  Symptom: Move command (mv) hangs system if both files are protected by
           ACLs.  Similarly passwd command hangs system if /etc/passwd  
           and temp file used by passwd are protected by ACLs.          

  Internal Defect 81702
  Symptom: File descriptor leak. File descriptors remain open on HP-UX. 

  Internal Defect 81748
  Symptom: TAMOS STREAMS routine ncttli_close() hangs indefinitely. Core
           dump will show ncttli_close() is waiting in pal_hp_cond_wait().

  Internal Defect 82250
  Symptom: Kernel drivers fail to load on HP-UX and Solaris. System logs
           report undefined symbol "pal_aix64_shmdt".

  Internal Defect 82662
  Symptom: Killing the "mv command" can cause a hang when both the source 
           and destination file are protected by policy. 

2.9 Problems fixed by patch 6.0.0-TIV-PDO-FP0013

  APAR IZ06605 
  Symptom: pdosaudview -F concise target SRN (ARS field) prints over multiple 
           lines. 

  APAR IZ15908
  Symptom: When reconfiguring TAMOS after ldap's ssl certificate has been 
           changed, pdoscfg (-registry_ssl_cacert or -ldap_ssl_cacert) 
           command does not update the kdb file resulting in the following
           pdosd log error when restarting TAMOS. 

           2008-02-26-19:42:53.865+00:00I----- 0x16B480C9 pdosd ERROR rgy ira 
           ira_handle.c 776 0x00000001 HPDRG0201E   Error code 0x74 was 
           received from the LDAP server. Error text: "Failed to connect to ssl
           server.".
           2008-02-26-19:42:53.866+00:00I----- 0x35A53082 pdosd ERROR osd pdosd
           cas_int.c 3558 0x00000001 AOSSD0130E   Authorization API failure: 
           [00000001:14c0130c] HPDMG0780E   The SSL handshake failed when 
           connecting to the LDAP server.

  APAR IZ17511
  Symptom: The PDOSD daemon cores due to exceeding the process limit size.

  APAR IZ19021
  Symptom: A TAMOS daemon can hang trying to manually terminate one of the 
           TAMOS daemons, such as PDOSD, using the "kill" command.  This hang 
           can occur if the process termination occurs while the TAMOS kernel 
           code is in the middle of a I/O read function or a cond_wait type 
           function and it returns with an errno of EINTR. 

  APAR IZ19024
  Symptom: Group owership of pam.conf changes unexpectly during running of 
           pdoscfg -login_policy on/off.

  APAR IZ20916
  Symptom: Sysroute of APAR IZ11437. PDOSD hangs after attempting to restart 
           TAMOS: using rc.osseal stop then rc.osseal start

  APAR IZ22110
  Symptom: PDOSD not terminating. 

  APAR IZ22281
  Symptom: AIX only. System can hang while trying to kill processes/task using 
           the process group ID.  This hang can only occur if there are several 
           processes running, which are being terminated at the same time using 
           the process group ID

  APAR IZ22320
  Symptom: PDOSD not terminating: rc.osseal stop" reports that PDOSD did not 
           terminate within 180 seconds and PDOSD will not terminate using 
           "kill -9" command

  Internal Defect 81353
  Symptom: HPUX and Linux only. After system reboot mknod error messages 
           may be seen.

  Internal Defect 83179
  Symptom: HPUX, Linux, Solaris only. ssh based logins (ssh, sftp, scp, etc.)
           that use authkey authentication will be denied login because the 
           PAM authorization phase does not run.  The log file 
           msg__pdoslpmd.log contains "No failure record was found for login 
           by <username>" errors.  See section  9.4 Secure Shell (SSH) 
           Authentication Key Usage for details.

  Internel Defect 83544
  Symptom: HPUX and Solaris only. Startup scripts altered to not load TAMOS
           STREAMS module after system reboot.  See section 9.5 Do Not Load
           TAMOS STREAMS module.

  Internel Defect 83823
  Symptom: PDOSD can, erroneously, set or reset ISOLATION mode, without
           performing an LDAP request to verify connectivity.  This wrong, 
           ISOLATION mode, state will only last for at most a few minutes.

3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
  
  Before installing this patch, review the following prerequisites and
  dependencies.

3.1 Back up Tivoli Access Manager for Operating Systems data

  Before applying any maintenance, be sure to back up your system.  Use 
  the pdosbackup command provided with the TAMOS product to back up TAMOS-
  specific data.  Documentation for the pdosbackup command is located in the 
  "IBM Tivoli Access Manager for Operating Systems Administration Guide, 
  Version 6.0."

4.0 INSTALLING THIS PATCH
-------------------------

  NOTE: Before installing this patch, be sure that you have reviewed the
  prerequisites and have completed the backup procedure in section 3.0,
  "BEFORE INSTALLING THIS PATCH".

  This README assumes that $PATCH is the path to your temporary directory.

4.1 Installing this fixpack on AIX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 6.0.0-TIV-PDO-AIX-FP0013.tar.Z
       # tar -xvf 6.0.0-TIV-PDO-AIX-FP0013.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a. List all untrusted files    

          # pdosobjsig -l untrusted
  
       b. Perform validation for untrusted files

       c. Retrust the untrusted files

          # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 6.0", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       # installp -a -g -X -d $PATCH/PDOS.rte_6.0.0.13.bff PDOS.rte

  6. Restart your system.  

       # shutdown -rF 

  7. Once your system has returned from restart, verify that objects defined 
     in the TAMOS TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start

4.2 Installing this fixpack on HP-UX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 6.0.0-TIV-PDO-HPUX-FP0013.tar.Z
       # tar -xvf 6.0.0-TIV-PDO-HPUX-FP0013.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a. List all untrusted files    

          # pdosobjsig -l untrusted
  
       b. Perform validation for untrusted files

       c. Retrust the untrusted files

          # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 6.0", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       # swinstall -s $PATCH/PDOSRTE000600-13.depot PDOSrte

  6. Restart your system.
  
       # cd /
       # shutdown -r now

  7. Once your system has returned from restart, verify that objects defined in
     the TAMOS TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start

4.3 Installing this fixpack on Linux systems
  
  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       Linux on IA32 and AMD64/EM64T
      
         # tar -xvf 6.0.0-TIV-PDO-Linux.i386-FP0013.tar

       Linux on zSeries 
 
         # tar -xvf 6.0.0-TIV-PDO-Linux.s390-FP0013.tar

       Linux on POWER, pSeries(R) and iSeries

         # tar -xvf 6.0.0-TIV-PDO-Linux.ppc-FP0013.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a. List all untrusted files    

          # pdosobjsig -l untrusted
  
       b. Perform validation for untrusted files

       c. Retrust the untrusted files

          # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 6.0", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       rpm --freshen <fixpackname> 

       where <fixpackname> is one of the following:

       Linux on IA32 and AMD64/EM64T
      
         PDOSrte-PDOSruntime-6.0.0-13.i386.rpm

       Linux on zSeries 
 
         PDOSrte-PDOSruntime-6.0.0-13.s390.rpm

       Linux on POWER, pSeries(R) and iSeries

         PDOSrte-PDOSruntime-6.0.0-13.ppc.rpm

  6. Restart your system.

       # shutdown -r now

  7. Once your system has returned from restart, verify that objects defined 
     in the TAMOS TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start

4.4 Installing this fixpack on Sun Solaris Operating Environment systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 6.0.0-TIV-PDO-Solaris-FP0013.tar.Z
       # tar -xvf 6.0.0-TIV-PDO-Solaris-FP0013.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a. List all untrusted files    

          # pdosobjsig -l untrusted
  
       b. Perform validation for untrusted files

       c. Retrust the untrusted files

          # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 6.0", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       Solaris 8 and 9

         cd $PATCH
         patchadd PDOSRTE000600-13

       Solaris 10:  

         cd  $PATH
         patchadd -t PDOSRTE000600-13

  6. Restart your system.

       # init 6

  7. Once your system has returned from restart, verify that objects defined 
     in the TAMOS TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start

5.0 UNINSTALLING THIS PATCH
---------------------------

  To remove the fixpack on UNIX systems, perform the following steps.

  1. Log in to the system as root.

  2. Stop the TAMOS processes.

     # rc.osseal stop

  3. At the command prompt, enter the following:

     AIX, reject the applied fixpack:

       installp -r PDOS.rte

     HP-UX, remove the fixpack:

       swremove PDOSrte,r=6.0.0.13

     Linux, apply the previous fixpack level:

       rpm -U --oldpackage <old_package>.  

         where <old_package> is one of the following:  

         Linux on IA32 and AMD64/EM64T
      
           PDOSrte-PDOSruntime-6.0.0-13.i386.rpm

         Linux on zSeries 
  
           PDOSrte-PDOSruntime-6.0.0-13.s390.rpm  

         Linux on POWER, pSeries and iSeries

           PDOSrte-PDOSruntime-6.0.0-13.ppc.rpm       

     Solaris, remove the fixpack:

       patchrm  PDOSRTE000600-13

   4. Restart your system to remove the patch's kernel modules/drivers.

6.0 AFTER INSTALLING THE PATCH
------------------------------

  Complete the following tasks after you have installed the patch.


6.1 Verifying fixpack level

  AMOS fixpacks are cumulative starting from the initial release.  AMOS
  binaries change between fixpacks only when a change is made to the
  binary.  The best method of determining the fixpack level on a system 
  is to run the pdosversion command. The current fixpack version is on 
  the "pdosversion" line of the output.  

  # pdosversion
  IBM Tivoli Access Manager for Operating Systems Runtime 6.0.0
  pdosversion 6.0.0.13 (080516c)
  libosseald 6.0.0.13 (080516a)
  libosseal 6.0.0.13 (080516a)
  libkosseal 6.0.0.0 (060329a)
  liblpm 6.0.0.0 (060329a)
  LRD_AuditInput 6.0.0.0 (060329a)
  LRD_EmailOutput 6.0.0.0 (060329a)
  LRD_FileOutput 6.0.0.0 (060329a)
  LRD_NetOutput 6.0.0.0 (060329a)

7.0 DOCUMENTATION UPDATES
-------------------------

  The product documentation for Tivoli Access Manager for Operating 
  Systems, Version 6.0, can be found at the following Web address 
  (entered as one line):

  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?toc=
      /com.ibm.itamos.doc/toc.xml

  Only installation and configuration updates will be fully documented in this
  README.  For discussion about TAMOS usage not related to installation or
  configuration, a pointer to IBM DCF Technotes will be listed.

7.1 Clarification of prerequisite TOUR pkg for HP-UX

  (HP PRE-REQS ARE NOT AVAILABLE FROM HP (IY83216))

  Entry modified in 6.0.0-TIV-PDO-FP0010.README

  The following information updates the TAMOS 6.0 Release Notes.

  Affected section:
  Chapter 2, "Supported operating systems and required patches"

  Transport Optional Upgrade Release (TOUR) package delivers Transport and 
  STREAMS functionality on the web and independently from major HP-UX 
  releases. TOUR is a Transport Web upgrade supported on the HP-UX 11i 
  operating system.

  For HP-UX PA-RISC Required Patches section, the following two references 
  to the TOUR package are outdated and disregard any references made to
  them:

  - TOUR_A.01.00_HP-UX_B.11.11_32+64.depot
  - Finally, install TOUR_A.01.00_HP-UX_B.11.11_32+64.depot, which will 
    rebuild the kernel and will reboot the system.
   
  TOUR support was required by the TAMOS 6.0 General Availability release
  to support IPv6. HP-UX has stopped delivering IPv6 support through TOUR. 
  packages.  Support for IPv6 is now support through Cumulative STREAMS 
  patches. Please consult the HP website for information about appropriate 
  patches required to support IPv6 on HP-UX 11i. (section modified by 
  6.0.0-TIV-PDO-FP0010)

7.2  Release Notes Correction for Solaris Prereqs 

  The TAMOS 6.0 Release Notes, page 14 and the 6.0.0-TIV-PDO-FP0001.README 
  file in section 1.2 "Architectures" incorrectly stated the "Required 
  Patches" for "Solaris on SunSparc". 

  Solaris 8, 
    patch 108434-14 is required for the 32-bit kernel
    patch 108435-15 is required for the 64-bit kernel
    The "Both kernels:" section is correct and remains unchanged.

  Solaris 9,
    patch 111711-08 is required for the 32-bit kernel
    patch 111712-08 is required for the 64-bit kernel

  This correction has been made to this README in Section 1.2.

7.3 Support and limitations for AIX 6.1 in fixpack 
    6.0.0-TIV-PDO-FP0010 and above.
 
  TAMOS fixpack 6.0.0-TIV-PDO-FP0010 and above support AIX 6.1.  

  Testing was completed with PD.RTE, IDS LDAP Client and GSKIT
  versions shipped with TAMOS 6.0 GA. 

  When installing TAMOS on AIX 6.1, follow these steps
    - Install the TAMOS 6.0 GA version for AIX.
    - Install TAMOS fixpack 10
    - Configure TAMOS using pdoscfg
    - Start TAMOS.

  Note:  Read this README's section 8.1 for restrictions when using
  TAMOS on AIX 6.1.

7.4 Support and limitations for RHEL 5 in fixpack 
    6.0.0-TIV-PDO-FP0012 and above.

  Login Policy attribute Login-MaxConcurrent does not work in RHEL5 and
  RHEL4. No work around available.

  Due to a PAM configuration change in RHEL5 the following Password Policy 
  Attributes do not work;
    Password-MinPasswordLen
    Password-MinPasswordAlpha
    Password-MinPasswordAlphaNum
  Work around available.

  See Section 9.3 for details.

7.5 Certified Applications.

  Applications certified since main release of TAMOS 6.0.

    OpenSSH versions certified since main release:  OpenSSH 4.4, 4.5 and 4.6

    Common Auditing Report Services (CARS) fixpack certified with this TAMOS 
    fixpack:  version 6.0.1.  Please contact TAMOS L2 support to obtain CARS 
    fixpacks.

7.6 Considerations when running on HACMP for AIX systems

  When running on a High Availability Cluster Multiprocessing (HACMP) for AIX
  system, you need to ensure that the appropriate actions are taken when a
  system is taken down and rolled over to another system in the HACMP cluster.
  This is necessary in all cases in which a system running TAMOS is shut down.
  In an HACMP pre-event script, shut down Tivoli Access Manager for Operating
  Systems. This can be done by adding "rc.osseal stop"  In an HACMP post-event
  script, which runs on the new system, restart Tivoli Access Manager for
  Operating Systems. This can be done by adding "rc.osseal start" This ensures
  that Tivoli Access Manager for Operating Systems runs in a consistent network
  environment. Consult the HACMP for AIX documentation for additional details.

8.0 SOFTWARE LIMITATIONS
------------------------

8.1 Virtualization Environments

  For all supported platforms (refer to section 1.2 Architectures) TAMOS does 
  not support operating system-level virtualized environments such as, HP 
  vPars, IBM WPAR, or Solaris Container/Zone. Running TAMOS on such systems 
  interferes with the virtualized operating system environments.  

  For all supported platforms (refer to section 1.2 Architectures) TAMOS does 
  not support virtualization environments such as, VMware or Parallels 
  Workstation.

  These are TAMOS product limitations. 

8.2  Linux kernel driver support

  TAMOS supports only specific Linux kernel drivers that are explicitly listed 
  in Section 1.2 of this fixpack's README.  New Linux kernel driver support is 
   periodically added with new TAMOS fixpack releases.

9.0 KNOWN PROBLEMS AND WORKAROUNDS
------------------------------------------------

9.1  SLES10/SLED10 Support Issues

9.1.1 SLES10/SLED10 prerequisite for pdksh

  SLES10 and SLED10 do not ship korn shell in the pdksh package. The korn 
  shell is shipped in the ksh-93r package. pdksh is a prequisite for the 
  IDS product. A workaround is to install the rpm package manually. Add 
  the '--nodeps' flag to the IDS rpm package install. 

9.1.2 SLES10/SLED10 AppArmor needs to be disabled

  SUSE ships AppArmor on both SLES10 and SLED10, which is a security 
  application that installs itself as a kernel module that uses the LSM 
  security hooks. AppArmor needs to be disabled for TAMOS to run.

  AppArmor:
    # /etc/init.d/boot.apparmor kill
  Then, to make it so it doesn't restart on reboot:
    # chkconfig -e boot.apparmor
    >> change to off

9.1.3 SLES10/SLED10 TAMOS autostart turns off parallel executing of 
      start scripts.

  By default, SUSE ships with a mechanism enabled that does allows the 
  /etc/init.d/rc script to run the various start up scripts in parallel. 
  This is controlled by the RUN_PARALLEL variable in the /etc/sysconfig/boot 
  configuration file. The TAMOS autostart feature does not work with this 
  parallel starting mechanism. When TAMOS autostart is configured on, 
  TAMOS will change the RUN_PARALLEL value to "no" so that the system uses 
  the usual start mechanism at boot time. 

  -- do not change this value to "yes", or else TAMOS will NOT autostart 
     as desired.

9.1.4 SLES10/SLED10 prerequisite for IDS Client

  IDS 6.0 Client Fixpack 3 is required for SLES10 support.

9.2 HP-UX Kernel Driver loading issue (Internal Defect 80530)

  When rc.kosseal is run after the an HP-UX system has been rebooted, the 
  TAMOS kernel driver intermittently fails to load.  The following error
  messages appear:

    Loading Tivoli Access Manager for Operating Systems kernel driver
    kminstall: WARNING: Module does not exist on the system
           Attempting to add the module to this system..
    Generating module: kazndrv...

    Specified module(s) below is(are) activated successfully.
         kazndrv

    kmadmin: kazndrv: No locks available
    AOSSR0142E   Tivoli Access Manager for Operating Systems kernel 
        driver load failed: 4
    AOSSR0132E   Tivoli Access Manager for Operating Systems startup 
        failure: kernel driver is not started

  This issue is due to HP-UX.  Try to start TAMOS again.  
  A workaround/fix is in progress that will attempt to reload the kernel 
  driver in case of this failure.  The fix will be delivered in a later 
  fixpack.
 
9.3 Red Hat Enterprise Linux 5 Support Issues

  There were 2 PAM related problems:

  1. Due a change in RHEL4 and RHEL5 the Login Policy attribute 
     Login-MaxConcurrent is not enforced. The change in RHEL4 and RHEL5 
     prevents the TAMOS PAM modules/routines which increment/decrement 
     login counters from being called during user logins. No work around 
     available.

  2. The following Password Policy Attributes do not work
       Password-MinPasswordLen
       Password-MinPasswordAlpha
       Password-MinPasswordAlphaNum
     The PAM configuration file syntax was changed in RHEL4 and RHEL5. The 
     work around requires modification of two files after TAMOS installation.

     A. Remove the following lines from /etc/pam.d/passwd

        auth     required pam_pdos.so.1 
        account  required pam_pdos.so.1 
        password required pam_pdos.so.1

     B. Change /etc/pam.d/system-auth from

	  password requisite  pam_cracklib.so try_first_pass retry=3
	  password sufficient pam_unix.so md5 shadow nullok try_first_pass 
	       use_authtok

        to the follows:

	  password requisite  pam_cracklib.so try_first_pass retry=3
	  password required   pam_pdostok.so.1 
	  password sufficient pam_pdos.so.1 

9.4 Secure Shell (SSH) Authentication Key Usage

  Secure Shell logins; ssh, sftp, scp, etc will be denied when the logins 
  use an authentication key.  The denials occur because the PAM authentication
  phase is not run when an authentication key is used.  TAMOS detects an
  authentication failure. 

  When an authentication key is required TAMOS needs to be notified.  The 
  notification is in the form of a tag placed in the /etc/pam.conf file.  To
  implement this feature modify the pam.conf file in the following manner by
  adding the string "ssh_authkey" to the account line where the TAMOS security
  library is called;

  Solaris

    sshd	auth 	required	pam_pdos.so.1
    sshd 	account	required	pam_pdos.so.1	ssh_authkey
    sshd	session	required	pam_pdos.so.1

  HPUX

    sshd	auth	required	libpam_pdos.1	
    sshd	account	required	libpam_pdos.1	ssh_authkey
    sshd	session	required	libpam_pdos.1

  During debugging sessions when an authentication key is in use you must 
  notify TAMOS as described above, along with the debug tag.  HPUX example 
  shown below;

  sshd	account required	libpam_pdos.so.1 ssh_authkey 0xffffffff
  -or-
  sshd	account required	libpam_pdos.so.1 0xffffffff ssh_authkey

9.5 Do Not Load TAMOS STREAMS module

  Under certain situations the loading the TAMOS STREAMS module is not
  desirable.  Two methods are avaliable for informating TAMOS not to load
  the STREAMS module; environment variable and tag file.

  The environment variable method;

    1. Set TAMOS autostart off.

       # pdoscfg -autostart off

    2. Reboot the system.

       HPUX

	 # cd /
	 # shutdown -r now

       Solaris

	 # init 6

    3. In the same shell set environment varible then start TAMOS.

       # export NOSTREAMSLOAD=1
       # rc.osseal start

  The tag file method;

    1. Shutdown TAMOS

       # rc.osseal stop

    2. Create tag file

       # touch /opt/pdos/etc/.nostreamsload

    3. Reboot system 

       HPUX

	 # cd /
	 # shutdown -r now

       Solaris

       # init 6

  To view loaded modules Note: kazntli should not be present after preforming
  one of the above methods.

    HPUX 11.00 - HPUX 11.11

      # kmadmin -s
      Name            ID      Status          Type
      =====================================================
      krm             1       UNLOADED        WSIO
      kazndrv         2       UNLOADED        WSIO
      kazntli         3       UNLOADED        STREAMS

    HPUX 11.23

      # kcmodule | grep kazn
      kazndrv          (now)        loaded  explicit  loadable, unloadable
      kazntli          (now)        loaded  explicit  loadable, unloadable

    Solaris 

      # modinfo | grep kazn
      269 782d2000  83180 239   1  kazndrv (KMSG driver v6.0_050120)
      270  13b2c15   3675  26   1  kazntli (Kosseal STREAMS v6.0.0)

  9.6 TAMOS 6.0 and TAMeb 6.1

    TAMOS 6.0 must be upgraded to 6.0.0-TIV-PDO-FP0010 or higher before upgrading 
    from TAMeb 6.0 to TAMeb 6.1. 

10.0 NOTICES
------------

  This information was developed for products and services offered in the 
  U.S.A. IBM may not offer the products, services, or features discussed in 
  this document in other countries. Consult your local IBM representative for
  information on the products and services currently available in your area. 
  Any reference to an IBM product, program, or service is not intended to 
  state or imply that only that IBM product, program, or service may be used. 
  Any functionally equivalent product, program, or service that does not 
  infringe any IBM intellectual property right may be used instead. However, 
  it is the user's responsibility to evaluate and verify the operation of any 
  non-IBM product, program, or service. IBM may have patents or pending patent
  applications covering subject matter described in this document. The
  furnishing of this document does not give you any license to these patents.
  You can send license inquiries, in writing, to:

  IBM Director of Licensing
  IBM Corporation
  North Castle Drive
  Armonk, NY 10504-1785
  U.S.A.

  For license inquiries regarding double-byte (DBCS) information, contact the
  IBM Intellectual Property Department in your country or send inquiries, in
  writing, to:

  IBM World Trade Asia Corporation
  Licensing
  2-31 Roppongi 3-chome, Minato-ku
  Tokyo 106, Japan

  The following paragraph does not apply to the United Kingdom or any other
  country where such provisions are inconsistent with local law: INTERNATIONAL
  BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
  WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
  TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS 
  FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
  implied warranties in certain transactions; therefore, this statement may 
  not apply to you.

  This information could include technical inaccuracies or typographical 
  errors. Changes are periodically made to the information herein; these 
  changes will be incorporated in new editions of the publication. IBM may 
  make improvements and/or changes in the product(s) and/or the program(s) 
  described in this publication at any time without notice.

  Any references in this information to non-IBM Web sites are provided for
  convenience only and do not in any manner serve as an endorsement of those 
  Web sites. The materials at those Web sites are not part of the materials 
  for this IBM product and use of those Web sites is at your own risk.

  IBM may use or distribute any of the information you supply in any way it
  believes appropriate without incurring any obligation to you.

  Licensees of this program who wish to have information about it for the
  purpose of enabling: (i) the exchange of information between independently
  created programs and other programs (including this one) and (ii) the mutual
  use of the information that has been exchanged, should contact:

  IBM Corporation
  2Z4A/101
  11400 Burnet Road
  Austin, TX 78758
  U.S.A.

  Such information may be available, subject to appropriate terms and
  conditions, including in some cases, payment of a fee.

  The licensed program described in this document and all licensed material
  available for it are provided by IBM under terms of the IBM Customer
  Agreement, IBM International Program License Agreement or any equivalent
  agreement between us.

  Any performance data contained herein was determined in a controlled
  environment. Therefore, the results obtained in other operating environments
  may vary significantly. Some measurements may have been made on
  development-level systems and there is no guarantee that these measurements
  will be the same on generally available systems. Furthermore, some 
  measurement may have been estimated through extrapolation. Actual results 
  may vary. Users of this document should verify the applicable data for their 
  specific environment.

  Information concerning non-IBM products was obtained from the suppliers of
  those products, their published announcements or other publicly available
  sources. IBM has not tested those products and cannot confirm the accuracy 
  of performance, compatibility or any other claims related to non-IBM 
  products. Questions on the capabilities of non-IBM products should be 
  addressed to the suppliers of those products.

  All statements regarding IBM's future direction or intent are subject to
  change or withdrawal without notice, and represent goals and objectives 
  only.

  This information contains examples of data and reports used in daily 
  business operations. To illustrate them as completely as possible, the 
  examples include the names of individuals, companies, brands, and products. 
  All of these names are fictitious and any similarity to the names and 
  addresses used by an actual business enterprise is entirely coincidental.
 
10.1 Trademarks
 
  The following terms are trademarks or registered trademarks of International
  Business Machines Corporation in the United States, other countries, or 
  both:

  AIX
  IBM
  IBM logo
  iSeries
  pSeries
  S/390
  Tivoli
  Tivoli logo
  xSeries
  zSeries

  Java and all Java-based trademarks and logos are trademarks of
  Sun Microsystems, Inc. in the United States, other countries, or both.

  Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
  Microsoft Corporation in the United States, other countries, or both.

  UNIX is a registered trademark of The Open Group in the United States and
  other countries.

  Other company, product, and service names may be trademarks or service marks
  of others.

End of IBM Tivoli Access Manager for Operating Systems, 
Patch 6.0.0-TIV-PDO-FP0013 README

