>I would never recommend giving a tape operator class A.. besides FORCE -- >they can SHUTDOWN the system .. also XAUTOLOG users. I can't think of an= >y >class A commands offhand that I would want a tape operator to have access >to. > >The 'right' way to restrict things is to determine which privileged command= >s >the tape operator needs to issue, and create a command class that gives >access to only those commands. (class T for example) I would think it >would be a fairly short list.. ATTACH/DETACH and some QUERY commands - and >maybe not even those depending on what you use for tape operations. > >But at a minimum - I would take away class A right now. > >Scott Rohling >
Another option is to create a different privilege class for the commands you don't want the operators to be able to issue (SHUTDOWN, FORCE, etc.) and only give that privilege class to those you want to authorize for those commands. John Franciscovich z/VM Development
