>From this excerpt, Netview 5.4 does pass the MVS commands on for security >checking. The difference now is that it is checking against the invoking userid, not that of the Netview operator.
In NetView V5R4 there was a change to allow the D (DISPLAY), F (MODIFY), and V (VARY) commands to be issued from a NetView operator task without the MVS prefix. These commands are now sent to the VTAM command processor where they are checked to determine if they are VTAM commands If they are not VTAM commands, they are forwarded to the MVS command processor (CNMCMVS) where they are processed the same as if they had been entered using the MVS command including security checking. -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Walt Farrell Sent: Friday, August 05, 2011 12:20 PM To: [email protected] Subject: Re: Netview security problem On Fri, 5 Aug 2011 11:58:45 -0400, Barkow, Eileen <[email protected]> wrote: >We do not want the give the user access to issue MVS commands - >That is not the way this worked. >The clist does specific functions which the user cannot do directly with MVS >commands. > >Netview 5.4 is doing security checking against the invoking userid which it >did not do before. >We need a way to stop it from doing so. Just to be clear, Netview is not doing security checking in the scenario you've showed us. Netview is issuing commands, and it's issuing them from the invoking user ID. It's MVS Console processing that's doing the security checking. I think your Netview person needs to be looking for Netview configuration parameters that control what user ID it runs work under. -- Walt Farrell IBM STSM, z/OS Security Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
