On Sun, 29 Oct 2017 21:07:33 +0200, Binyamin Dissen <[email protected]> wrote:
>On Sun, 29 Oct 2017 16:00:20 +0100 Peter Hunkeler <[email protected]> wrote: > >:>>The TSO TMP is designed to be attached only by EXEC PGM=IKJEFTxx, or by the >TSO/E Session Manager (when Session Manager is the EXEC PGM= on the logon >proc). Attaching the TMP by any other program is unsupported. > >:>>Attaching the TMP in an IMS dependent region or a CICS AOR will violate the >System Integrity and thus the security of your system, since it will allow the >unauthorized transaction programs in those regions to take over the system in >anyway that they desire. > >:>This raises the question then, why does IKJEFTxx *not* check this and fail >if not run as job step task? > >Because it requires APF to invoke the TMP. And if you allow your CICS or IMS >to run APF, this is the least of your problems. > What's the precise definition of a "job step (jobstep? usage?) task? I've regularly used the Rexx ADDRESS TSO surrogate, available only under UNIX, not IRXJCL, which fork()s a child address space in which the TMP runs to much avail. I know of no attendant integrity exposure. Does this meet the definiton (stated where?) of a job step task? What about using BPX1EXM to start a TMP? (I've not tried that.) (The Glossary of z/OS terms and abbreviations discusses "job step" only in connection with batch JCL. RCF?) (OK. The description of BPX1EXM says it "inserts a new step". I suppose that makes the program invoked a "job step task". I don't see that the UNIX Rexx manual mentions a job step.) -- gil ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
