Patch Name: PHCO_20467

Patch Description: s700_800 10.26 libsecurity cumulative patch

Creation Date: 00/01/26

Post Date:  00/04/13

Hardware Platforms - OS Releases:
	s700: 10.26
	s800: 10.26

Products: N/A

Filesets:
	BLS.BLS-CORE BLS.BLS-ENG-A-MAN BLS.MAXSIX
	ProgSupport.PROG-MIN

Automatic Reboot?: Yes

Status: General Superseded

Critical:
	No (superseded patches were critical)
	PHCO_18179: MEMORY_LEAK

Path Name: /hp-ux_patches/s700_800/10.X/PHCO_20467

Symptoms:
	PHCO_20467:
	The system hangs as a result of crashed mandatory
	access policy daemon (macilbd).

	PHCO_20430:
	On starting the NIS client processes on the NIS master
	machine, ypullc starts hogging the CPU time.

	PHCO_19042:
	Smartcard does not password authenticate correctly

	PHCO_18502:
	Functions to access protected password database that take
	directory as argument do not exist.
	Getprpwent function stops returning nis entries after
	it returns the first one.

	PHCO_18179:
	Memory leak in security policy daemons

	PHCO_17856:
	We need to create strsecerror function in libsecurity.
	It should work the same way as psecerror except that it
	returns the message string instead of sending it to the
	standard error.

	PHCO_17760:
	There is no way to get the classification string from
	an IR in all Encodings cases. Additionally, the SHORT_WORDS
	specifier has no effect on the returned classification. It
	always returns the long form.

Defect Description:
	PHCO_20467:
	Each security policy daemon maintains a cache of its
	security policy database pages to reduce the I/O. The
	cache is being implemented as a list of fixed number of
	buffers. It uses the Least Recently Used (LRU) policy to
	pick a buffer for reuse.  In certain conditions, the daemon
	fails to pick any buffer even if buffers are available.
	It results in a crash of security policy daemons

	PHCO_20430:
	On starting the yppullc, it starts monitoring the password
	and group maps on the NIS master machine for the updates.
	On detecting a change, it triggers the regeneartion of
	pw_id_map and gr_id_map on all the clients. These maps are
	generated in the context of yppullc or any other processes
	whoever tries to map the user name or group name to its id
	first. Most of the time, it happens in the context of
	yppullc. Because of a defect in the map generation logic,
	it loops forever.

	PHCO_19042:
	The password changing commands need to know
	CRString for a new password to perform the password history
	checks. Currently, these commands are invoking
	smartcard_PWchange() twice in succession to achieve this
	functionality. The first invokation sets the new password
	and the second invokation restores the old password. This is
	just a workaround which is causing problem in developing the
	Smartcard hook library.

	Resolution: Added a new hook in the libSmartCard library to
	get the CRstring for a new passwword without writing into
	the Smart Card. All the commands which change the user
	passwords have been modified to invoke the hook.

	PHCO_18502:
	Functions fgetprpwnam and fputprpwnam need to be created.
	They will read/write protected password entry from the
	desired directory. NIS does not need to be up.
	Getprpwent function is calling other functions which will
	reset the pointer when NIS users are accessed.

	Resolution:
	Two new functions are created:
	struct pr_passwd *fgetprpwnam(char *nam, char *authdir)
	int
	fputprpwnam(char *nam, struct pr_passwd *p, char *authdir)
	They can be used to access any desired protected password
	directory and read and write entries from there.
	Getprpwent function was redesigned so that it does not
	call the function that reset the entry pointer so that all
	the entries are now correctly returned.

	PHCO_18179:
	The daemon fails to release the lock on the memory
	page in some error cases. This results a process
	space memory leak.  This size of the daemon grows
	over a long period of time and eventually the daemon
	dies and the system becomes unusable.

	Resolution:
	Release page lock under error conditions.

	PHCO_17856:
	New requirement.

	Resolution:
	Create the function and the man page.

	PHCO_17760:
	New requirement.

	Resolution:
	Provide a new interface to retrieve classification from a
	valid IR.

SR:
	1653309872

Patch Files:
	/usr/lib/libsec.a(smartcard.o)
	/usr/lib/libsec.a(map_ids.o)
	/usr/lib/libsecurity.1
	/tcb/bin/acld
	/tcb/bin/dbck
	/tcb/bin/m6d
	/tcb/bin/m6dbck
	/tcb/bin/m6mkdb
	/tcb/bin/macilbd
	/tcb/bin/mkdb
	/usr/include/mandatory.h
	/usr/lib/libsec.a(mandlib.o)
	/usr/lib/libsec.a(psecerror.o)
	/usr/lib/libsec.a(getprpwent.o)
	/usr/lib/libsec.a(authcap.o)
	/usr/share/man/man3.Z/mand.3
	/usr/share/man/man3.Z/mand_ir_to_class_er.3
	/usr/share/man/man3.Z/psecerror.3
	/usr/share/man/man3.Z/strsecerror.3

what(1) Output:
	/usr/lib/libsec.a(smartcard.o):
		99/06/25 lib/libsecurity/smartcard.c, hpux, hpux_10.
			26, ic5cv Revision 1.4 PATCH_10.26 (PHCO_190
			42)
	/usr/lib/libsec.a(map_ids.o):
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5dw Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
	/usr/lib/libsecurity.1:
		1999/11/09 Hewlett-Packard HP-UX 10.26 TOS [ ic5dw -
			 DAV17 ]
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5dw Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		99/05/21 lib/libsecurity/getprpwent.c, hpux, hpux_10
			.26, ic5dw Revision 1.25 PATCH_10.26 (PHCO_1
			8502)
		99/11/09 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5dw Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5dw Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		99/03/09 lib/libsecurity/psecerror.c, hpux, hpux_10.
			26, ic5dw Revision 1.4 PATCH_10.26 (PHCO_178
			56)
		99/05/21 lib/libsecurity/chsecattr.c, hpux, hpux_10.
			26, ic5dw Revision 1.3 PATCH_10.26 (PHCO_185
			02)
		99/06/25 lib/libsecurity/smartcard.c, hpux, hpux_10.
			26, ic5dw Revision 1.4 PATCH_10.26 (PHCO_190
			42)
	/tcb/bin/acld:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/dbck:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		00/01/05 lib/libc/core/gen/ctime.c, hpux, hpux_10.26
			, ic5eb Revision 1.2 PATCH_10.26 (PHCO_17823
			) UNMODIFIED
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/m6d:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		00/01/05 lib/libc/core/gen/ctime.c, hpux, hpux_10.26
			, ic5eb Revision 1.2 PATCH_10.26 (PHCO_17823
			) UNMODIFIED
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		seccmd/msix/m6d.c, m6d, hpux_mlpmp, mlpmp6 $Date: 96
			/12/04 15:47:33 $Revision: 1.22 PATCH_10.16
			(PHCO_7524)
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/m6dbck:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		00/01/05 lib/libc/core/gen/ctime.c, hpux, hpux_10.26
			, ic5eb Revision 1.2 PATCH_10.26 (PHCO_17823
			) UNMODIFIED
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/m6mkdb:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		00/01/05 lib/libc/core/gen/ctime.c, hpux, hpux_10.26
			, ic5eb Revision 1.2 PATCH_10.26 (PHCO_17823
			) UNMODIFIED
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/macilbd:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		00/01/05 seccmd/secpolicy/macilbd.c, hpux, hpux_10.2
			6, ic5eb Revision 1.6 PATCH_10.26 (PHCO_1776
			0)
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/tcb/bin/mkdb:
		HP92453-02A.10.00 HP-UX SYMBOLIC DEBUGGER (END.O) $R
			evision: 74.03 $
		00/01/05 lib/libc/core/gen/ctime.c, hpux, hpux_10.26
			, ic5eb Revision 1.2 PATCH_10.26 (PHCO_17823
			) UNMODIFIED
		2000/01/05 Hewlett-Packard HP-UX 10.26 TOS [ ic5eb -
			 DAV17 ]
		99/11/15 seccmd/secpolicy/spdbm.c, hpux, hpux_10.26,
			 ic5eb Revision 1.7 PATCH_10.26 (PHCO_20467)
		99/11/09 lib/libsecurity/map_ids.c, hpux, hpux_10.26
			, ic5eb Revision 1.13 PATCH_10.26 (PHCO_2043
			0)
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_18502
			)
		00/01/05 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5eb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
		ic5ae_DAV17 lib/libc/archive_pa1/libc.a_01
		Jan  6 2000 01:02:00
	/usr/include/mandatory.h:
		$Revision: 1.6 include/mandatory.h, hpux, hpux_10.26
			, ic5bb $ $Date: 99/02/25 16:11:03 $ Hewlett
			-Packard Co. */
		99/02/26 include/mandatory.h, hpux, hpux_10.26, ic5b
			b Revision 1.6 PATCH_10.26 (PHCO_17760) */
	/usr/lib/libsec.a(mandlib.o):
		99/02/26 lib/libsecurity/mandlib.c, hpux, hpux_10.26
			, ic5bb Revision 1.5 PATCH_10.26 (PHCO_17760
			) $
	/usr/lib/libsec.a(psecerror.o):
		99/03/09 lib/libsecurity/psecerror.c, hpux, hpux_10.
			26, ic5bo Revision 1.4 PATCH_10.26 (PHCO_178
			56)
	/usr/lib/libsec.a(getprpwent.o):
		99/05/21 lib/libsecurity/getprpwent.c, hpux, hpux_10
			.26, ic5cn Revision 1.25 PATCH_10.26 (PHCO_1
			8502)
	/usr/lib/libsec.a(authcap.o):
		99/05/21 lib/libsecurity/authcap.c, hpux, hpux_10.26
			, ic5cn Revision 1.5 PATCH_10.26 (PHCO_18502
			)
	/usr/share/man/man3.Z/mand.3:
		None
	/usr/share/man/man3.Z/psecerror.3:
		None
	/usr/share/man/man3.Z/mand_ir_to_class_er.3:
		None
	/usr/share/man/man3.Z/strsecerror.3:
		None

cksum(1) Output:
	2147740892 3872 /usr/lib/libsec.a(smartcard.o)
	1718578089 25084 /usr/lib/libsec.a(map_ids.o)
	3319853360 380928 /usr/lib/libsecurity.1
	596436091 518912 /tcb/bin/acld
	596215686 642868 /tcb/bin/dbck
	2058647949 2093192 /tcb/bin/m6d
	1535584545 645496 /tcb/bin/m6dbck
	1720706064 626336 /tcb/bin/m6mkdb
	3702510289 555876 /tcb/bin/macilbd
	3935044982 626336 /tcb/bin/mkdb
	2696317173 12952 /usr/include/mandatory.h
	3481558456 13080 /usr/lib/libsec.a(mandlib.o)
	23154580 2072 /usr/lib/libsec.a(psecerror.o)
	4289577938 17108 /usr/lib/libsec.a(getprpwent.o)
	401969751 14232 /usr/lib/libsec.a(authcap.o)
	11071229 10246 /usr/share/man/man3.Z/mand.3
	1539658251 1088 /usr/share/man/man3.Z/psecerror.3
	11071229 10246 /usr/share/man/man3.Z/mand_ir_to_class_er.3
	1539658251 1088 /usr/share/man/man3.Z/strsecerror.3

Patch Conflicts: None

Patch Dependencies:
	s700: 10.26: PHKL_17761 PHCO_18636 PHCO_19290
	s800: 10.26: PHKL_17762 PHCO_18636 PHCO_19290

Hardware Dependencies: None

Other Dependencies: None

Supersedes:
	PHCO_18502 PHCO_18179 PHCO_17856 PHCO_17760 PHCO_19042 PHCO_20430

Equivalent Patches: None

Patch Package Size: 6140 KBytes

Installation Instructions:
	Please review all instructions and the Hewlett-Packard
	SupportLine User Guide or your Hewlett-Packard support terms
	and conditions for precautions, scope of license,
	restrictions, and, limitation of liability and warranties,
	before installing this patch.
	------------------------------------------------------------
	1. Back up your system before installing a patch.

	2. Login as root.

	3. Copy the patch to the /tmp directory.

	4. Move to the /tmp directory and unshar the patch:

		cd /tmp
		sh PHCO_20467

	5a. For a standalone system, run swinstall to install the
	    patch:

		swinstall -x autoreboot=true -x match_target=true \
			-s /tmp/PHCO_20467.depot

	By default swinstall will archive the original software in
	/var/adm/sw/patch/PHCO_20467.  If you do not wish to retain a
	copy of the original software, you can create an empty file
	named /var/adm/sw/patch/PATCH_NOSAVE.

	WARNING: If this file exists when a patch is installed, the
	         patch cannot be deinstalled.  Please be careful
		 when using this feature.

	It is recommended that you move the PHCO_20467.text file to
	/var/adm/sw/patch for future reference.

	To put this patch on a magnetic tape and install from the
	tape drive, use the command:

		dd if=/tmp/PHCO_20467.depot of=/dev/rmt/0m bs=2k

Special Installation Instructions: None