<By the way, putting my security hat on for a moment, I'd like to know more <about why your application (or its developers) need to do a security check <based on a data set name.
<The system will do the checks for you at OPEN time, and any check your <application makes may get the wrong answer in some set of circumstances. In <my opinion it's usually poor application design to make a dsname check. You <really should let the system do it for you, as it's going to anyway. (But <again, I'd like to understand your scenario and why you think the <application needs to make the check.) <-- <Walt Farrell <IBM STSM, z/OS Security Design I question Walt's statement above in one case and one case only. The quote below is from the z/OS V1R11 manual Using Data Sets SC26-74410-09: <quote> 1.5.1.1 RACF Protection for VSAM Data Sets A catalog that contains a VSAM data set does not have to be RACF protected for its data sets to be RACF protected. If a user-security-verification routine (USVR) exists, it is not invoked for RACF-defined data sets. Deleting any type of RACF-protected entry from an RACF-protected catalog requires alter-level authorization for the catalog or the entry being deleted. Alter authority for the catalog itself is not sufficient for this operation. Note: VSAM OPEN routines bypass RACF security checking if the program issuing OPEN is in supervisor state or protection key 0." </quote> I call your attention to the last paragraph. I have been hoping that IBM will find a way to eliminate this restriction so I won't have to do my own RACROUTE REQUEST=AUTH for every VSAM data set I open when I'm in supervisor state or key zero. I would imagine that not very many COBOL programs run in supervisor state or key zero, but Walt Farrell put on his security hat (his words) so I thought it might be proper to continue his line of thought. I apologize in advance if I am out of line here. Andy Coburn ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
