On Thursday, 08/18/2011 at 12:56 EDT, Troy A Slaughter <[email protected]> wrote: > I'm trying to figure out the best way to define authority to a SYSPROG group > under RACF/VM. I don't want SYSPROG members to have all authority so I don't > want to just add SPECIAL and OPERATION attributes to the group. But they > should be able to perform system-wide list operations and such. I also want > them to have certain system display capabilities. It seems the only way to do > that is via privilege classes. If I'm right, it looks like I will be doing a > combination of RACF alterations to the SYSPROG group as well as privilege class > changes to the individual system IDs.
Even with RACF (or any other security product), the vast majority of CP commands and functions continue to be controlled by the CP privilege class and the OPTION statement in the directory. RACF cannot *add* commands to a virtual machine's command set; it can only *disallow* commands and functions they have access to. Specifically, CP allows RACF to limit: - STORE HOST - FOR - TRSOURCE - XAUTOLOG - Diagnose 0xE4 - Diagnose 0x88 So just make sure all the virtual machines in your SYSPROG group have privilege classes ABCDEG. Disclaimer: Once you give someone class C authority and the ability to modify SYSTEM CONFIG, they can do whatever they want., up to and including giving themselves SPECIAL and OPERATIONS authority, as well as the ability to issue the above commands/diagnose. While there are RACF techniques to make that mountain more difficult to climb, the mountain top is still attainable. Dealing with this is on the To Do list, but it comes under the heading of "Be careful what you wish for - you might get it." Full separation of duties on z/VM (and z/OS, btw) is not based on technology, but depends on the personal integrity of the system programmers. Until we have M5 or SkyNet, the humans remain firmly in control of the machines. (Fvvo "firmly".) Alan Altmark Senior Managing z/VM and Linux Consultant IBM System Lab Services and Training ibm.com/systems/services/labservices office: 607.429.3323 mobile; 607.321.7556 [email protected] IBM Endicott ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/
