On Wednesday, 07/14/2010 at 02:03 EDT, Gregg <[email protected]> wrote:
> So if it can't be controlled at the LParr, then priv class C(B too?)
> needs to be locked down to the few MVS security folk trust.

- Never give privilege class C to anyone who is not a trained AND trusted 
z/VM systems programmer.
- Never give privilege class B to anyone just so they can issue the ATTACH 
and VARY commands.  Instead, define them as privclass BQ and give your 
trusted MVS people privclass GQ.   (e.g. MODIFY COMMAND ATTACH PRIVCLASS 
BQ)

Alan Altmark
z/VM Development
IBM Endicott

Reply via email to