Link-editing with AC=1 isn't enough. The module must also reside in an APF-authorized library; otherwise the AC=1 is ignored.

However, his module could just be an 'innocent' changed version of an existing production one which he is now checking (or debugging) before it goes into prodution. So it would be concatenated ahead of the current production loadlib for that (to execute the other production modules that have not been changed). Meanwhile, all the libraries on his STEPLIB need to be APF'd for the jobstep to be authorized. There will probably be not only production loadlibs but also run-time system ones (e.g. for SORT, LE etc.) If he concatenates his non-APF'd test library on STEPLIB, the whole jobstep will then be non-authorized and will most likely fail. So the quickest solution is to APF-authorize his test library, execute the jobstep that needs to run authorized and then un-APF it afterwards.

There will always be 'risks' with APF'd libraries in the wrong hands. It's up to the security administrator to grant MVS SETPROG authority only to trusted developers.


Wayne Bickerdike wrote:

Isn't the answer link edit AC=1? He asked about a module,not a library.The
subject of SYSLMOD must be APF authorised...Do we care?





On Tue, Nov 12, 2013 at 12:55 PM, CM Poncelet <[email protected]> wrote:

The question was about how to APF-authorize a program in a single JCL
jobstream.

The answer to that question is:


"//*-------------------------------------------------------------------* "
"//* APF-AUTHORISE OUR STEPLIB DATASET(S)                              * "
"//*-------------------------------------------------------------------* "
"//ADDAPF  EXEC PGM=IEBGENER                                             "
"//SYSPRINT  DD SYSOUT=*                                                 "
"//SYSIN     DD DUMMY                                                    "
"//SYSUT2    DD SYSOUT=(*,INTRDR)                                        "
"//SYSUT1    DD *,DLM=@@                                                 "
"/*$VS,'SETPROG APF,ADD,DSN=<your loadlib DSN>,SMS'                      "
"@@                                                                      "
"//*                                                                     "
"//*-------------------------------------------------------------------* "
"//* RUN PROGRAM WHATEVER APF-AUTHORISED                               * "
"//*-------------------------------------------------------------------* "
"//WHATEVER EXEC PGM=WHATEVER                                            "
"//STEPLIB   DD DISP=SHR,DSN=<your loadlib DSN>                          "
"//DD1       DD DISP=SHR,DSN=<whatever #1>                               "
"//DD...     DD DISP=SHR,DSN=<whatever #...>                             "
"//DDn       DD DISP=SHR,DSN=<whatever #n>                               "
"//*                                                                     "
"//*-------------------------------------------------------------------* "
"//* APF-UNAUTHORISE OUR STEPLIB DATASET(S)                            * "
"//*-------------------------------------------------------------------* "
"//DELAPF  EXEC PGM=IEBGENER                                             "
"//SYSPRINT  DD SYSOUT=*                                                 "
"//SYSIN     DD DUMMY                                                    "
"//SYSUT2    DD SYSOUT=(*,INTRDR)                                        "
"//SYSUT1    DD *,DLM=@@                                                 "
"/*$VS,'SETPROG APF,DELETE,DSN=<your loadlib DSN>,SMS'                   "
"@@                                                                      "
"//*                                                                     "

"In ADDAPF and DELAPF above, replace ",SMS" with ",VOLUME=<volser of your
loadlib>" if the loadlib to be APF'd is not SMS-managed. "
"If the format of the APF list is static, add the following card before
the 1st "/*$VS,'SETPROG APF,ADD,DSN=<etc.>" card in step ADDAPF: "
"/*$VS,'SETPROG APF,FORMAT=DYNAMIC' "

Whether (or not) the user is authorized to issue MVS SETPROG commands is
not part of the question. Hence any 'discussion' that deviates from
answering the question at hand is just waffle.

(BTW It looks like all examples of JCL need to be enclosed in quotes ...
to avoid freaking-out the 'LISTSERV' <grin>.)

Cheers,

Chris Poncelet
IBM Systems Programming Consultant (retired)
Logic Integration Limited




Mark Zelden wrote:

On Mon, 11 Nov 2013 09:27:01 -0800, Jon Perryman <[email protected]>
wrote:



Dynamic APF exists for sysprog test system and emergency situations.

<snip>

Valid, but I would argue that the *main* reason dynamic APF (and dynamic
"anything" related to parmlib type updates) exists is "IPL avoidance" / 24
x 7 operations.   Many
shops still limit APF and LNKLST changes to (mostly) IPLs (including
clients of
mine), but that is a throw back to days of old.   The only disadvantage
of doing
these changes dynamically all the time is that eventually you will IPL
and without
good change control, changes could get regressed or errors in syntax etc.
at IPL time may be found.
Mark
--
Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS  mailto:
[email protected]     ITIL v3 Foundation Certified
             Mark's MVS Utilities: http://www.mzelden.com/mvsutil.htmlSystems 
Programming expert at
http://search390.techtarget.com/ateExperts/
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN




----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN





----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN

Reply via email to