On Thu, 23 Jun 2011 09:09:55 -0400, Haynes, Stan <[email protected]> wrote:
>Interestingly, this is something being discussed in our shop right now. We have an application with >code that extracts a DSN by searching through the TIOT, in order to perform some security check. >We (z/OS support division) fear that this user code is vulnerable to changes in z/OS control block >layout, with the possibility of having one of your LOB (Line Of Business) apps down. The app >people even asked if IBM would warn them of such cblock changes: Specifically for the question about using the TIOT to find the dsname, doing it the proper way via the TIOT should be safe, but finding it in an improper way could easily break. And we had a discussion in an internal IBM discussion just recently where someone had done it the wrong way and his code broke. So we really can't answer that specific question without knowing exactly what you've done. Some changes IBM warns customers about, and some we warn only vendors about. And some we may not warn anyone about. And some changes (like the one I mention above) are old changes that don't bite you unless you choose some particular system option (such as requesting SWA above the line, in this case). So it's better not to go poking around in control blocks if you don't need to, and if you need to you should only use blocks and fields we've identified as "intended programming interfaces". If those blocks or fields change incompatibly we do generally warn everyone, and we try not to change them incompatibly in the first place. By the way, putting my security hat on for a moment, I'd like to know more about why your application (or its developers) need to do a security check based on a data set name. The system will do the checks for you at OPEN time, and any check your application makes may get the wrong answer in some set of circumstances. In my opinion it's usually poor application design to make a dsname check. You really should let the system do it for you, as it's going to anyway. (But again, I'd like to understand your scenario and why you think the application needs to make the check.) -- Walt Farrell IBM STSM, z/OS Security Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
