IBM Z and LinuxONE IBM Z

 View Only

 Permission denied when trying to run zcryptstats

Henrik Lyksborg's profile image
Henrik Lyksborg posted Tue October 28, 2025 04:10 AM

Helle - I am running on a z16 with RHEL 9.6 and a number of CEX8 crypto cards.When trying to run zcryptstats I get permission denied, both as my own user and as root.Any ideas ?

Neale Ferguson's profile image
Neale Ferguson IBM Champion posted Wed October 29, 2025 08:17 AM

What does the following command report:

ls -l `which zcryptstats` 

What do you see if you run and examine the file stats.trc using the command?

strace -o stats.trc -f zcryptstats

Are you running selinux with setenforce on?

Henrik Lyksborg's profile image
Henrik Lyksborg posted Wed October 29, 2025 08:52 AM

$ ls -l `which zcryptstats`
-rwxr-xr-x. 1 root root 60224 Jan 30  2025 /usr/sbin/zcryptstats

$ strace -o stats.trc -f zcryptstats
Linux 5.14.0-570.39.1.el9_6.s390x (cccukol257.pok.stglabs.ibm.com)     10/29/25    s390x

zcryptstats: Failed to get card crypto measurement data: Permission denied

$ getenforce returns   Enforcing

same result with root and own userID

Neale Ferguson's profile image
Neale Ferguson IBM Champion posted Wed October 29, 2025 08:59 AM

In the file stats.trc you should see exactly which API is returning the EPERM: grep EPERM stats.trc

Henrik Lyksborg's profile image
Henrik Lyksborg posted Thu October 30, 2025 09:28 AM

Actually there are no EPERM in the trace.

I looked into it and the main thing was a missing libc.so.6

I made a syslink for that to a location where zcryptstats is looking.

That triggered an error with a missing ld.so.preload that I can not figure out how to work around.

The return is still permission denied.

Attachment  View in library
stats.txt 3 KB
Neale Ferguson's profile image
Neale Ferguson IBM Champion posted Fri October 31, 2025 08:09 AM

That libc.so.6 error seems strange. A RHEL 9.6 system wouldn't work without it. Here's what an ldd of the executable looks like on my system:

[neale@s390x-builder02 ~]$ ldd `which zcryptstats`
linux-vdso64.so.1 (0x000003fff4983000)
libc.so.6 => /lib64/libc.so.6 (0x000003ffa0400000)
/lib/ld64.so.1 (0x000003ffa0800000
Would you do the same (with and without the symlink you created)?
I don't have any crypto cards visible to the virtual machine so cannot get very far with it. Are you able to upload the stats.trc file here?
Neale
Henrik Lyksborg's profile image
Henrik Lyksborg posted Fri October 31, 2025 09:25 AM

With symlink

ldd `which zcryptstats`
    linux-vdso64.so.1 (0x000003ffcba84000)
    libc.so.6 => /usr/lib64/glibc-hwcaps/z16/libc.so.6 (0x000003ff85200000)
    /lib/ld64.so.1 (0x000003ff85500000)

Without symlink

ldd `which zcryptstats`
    linux-vdso64.so.1 (0x000003ffd56fe000)
    libc.so.6 => /usr/lib64/libc.so.6 (0x000003ff81200000)
    /lib/ld64.so.1 (0x000003ff81500000)

The stats.txt from my previous post is the trace from after the symlink was inserted.

Without the symlink the trace is back to app. 300 entries with the libc.so.6 missing.  

Related Content