On Thu, 23 Jun 2011 11:01:56 -0400, Andy Coburn <[email protected]> wrote:
>I question Walt's statement above in one case and one case only. The quote >below is from the z/OS V1R11 manual Using Data Sets SC26-74410-09: > ><quote> >...snipped (by Walt)... > >Note: VSAM OPEN routines bypass RACF security checking if the program >issuing OPEN is in supervisor state or protection key 0." > ></quote> > >I call your attention to the last paragraph. I have been hoping that IBM >will find a way to eliminate this restriction so I won't have to do my own >RACROUTE REQUEST=AUTH for every VSAM data set I open when I'm in supervisor >state or key zero. > >I would imagine that not very many COBOL programs run in supervisor state or >key zero, but Walt Farrell put on his security hat (his words) so I thought >it might be proper to continue his line of thought. I apologize in advance >if I am out of line here. You're not out of line at all, Andy, and that's one point I sometimes forget about. Thanks. But as you note, it should affect very few applications (not just COBOL, but I expect that few programs using VSAM are running in supervisor state or key 0. I also wish VSAM processing would provide a way of doing that check for you. I considered it a major breakthrough a number of years ago just getting them to document that point so people would know about it. Note that it's difficult for you to do the check correctly, as: (a) You need to know that you have to use the cluster name, not the data or index component name (b) You need to know the volser of the catalog (not of the component you're opening) so you can specify it on the RACROUTE REQUEST=AUTH. Of course, this means you need to find out the name of the catalog so you can then find its volser. (c) You need to know whether the RACF indicator in the cluster's sphere record is on or off, so you can properly specify RACFIND on the RACROUTE REQUEST=AUTH. So you need to retrieve that information from the catalog, too. Luckily, now that they've provided and documented the catalog search interface you can get all that info. In the good old days you had to use undocumented SVC 26 features before you had any hope of doing the authorization check correctly yourself. But still, they should at least provide an option (an ACB flag, or something) to allow you to ask OPEN to do the check for you. However (getting back to the original question I responded to) what I usually see when someone thinks their application should do the check is an attempt to avoid adding recovery for a possible S913 ABEND that they'll get if they just do an OPEN when the user isn't authorized. But unfortunately there are a number of ways that can go wrong, depending on how the administrators have decided to protect the data set, and on how well the application programmer implemented the check. And I've seen it go wrong both ways, with the application either incorrectly deciding the user would have access, or incorrectly deciding the user would not have access. -- Walt Farrell IBM STSM, z/OS Security Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
