On Thursday, 08/18/2011 at 12:56 EDT, Troy A Slaughter <[email protected]>
wrote:
> I'm trying to figure out the best way to define authority to a SYSPROG
group
> under RACF/VM.  I don't want SYSPROG members to have all authority so I
don't
> want to just add SPECIAL and OPERATION attributes to the group.  But
they
> should be able to perform system-wide list operations and such.  I also
want
> them to have certain system display capabilities.  It seems the only way
to do
> that is via privilege classes.  If I'm right, it looks like I will be
doing a
> combination of RACF alterations to the SYSPROG group as well as
privilege class
> changes to the individual system IDs.

Even with RACF (or any other security product), the vast majority of CP
commands and functions continue to be controlled by the CP privilege class
and the OPTION statement in the directory.

RACF cannot *add* commands to a virtual machine's command set; it can only
*disallow* commands and functions they have access to.  Specifically, CP
allows RACF to limit:
- STORE HOST
- FOR
- TRSOURCE
- XAUTOLOG
- Diagnose 0xE4
- Diagnose 0x88

So just make sure all the virtual machines in your SYSPROG group have
privilege classes ABCDEG.

Disclaimer:  Once you give someone class C authority and the ability to
modify SYSTEM CONFIG, they can do whatever they want., up to and including
giving themselves SPECIAL and OPERATIONS authority, as well as the ability
to issue the above commands/diagnose.

While there are RACF techniques to make that mountain more difficult to
climb, the mountain top is still attainable.  Dealing with this is on the
To Do list, but it comes under the heading of "Be careful what you wish
for - you might get it."  Full separation of duties on z/VM (and z/OS,
btw) is not based on technology, but depends on the personal integrity of
the system programmers.   Until we have M5 or SkyNet, the humans remain
firmly in control of the machines.  (Fvvo "firmly".)

Alan Altmark

Senior Managing z/VM and Linux Consultant
IBM System Lab Services and Training
ibm.com/systems/services/labservices
office: 607.429.3323
mobile; 607.321.7556
[email protected]
IBM Endicott

----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/

Reply via email to