Re: Using MGCRE with JES2 Commands

[Peter Relson]

This just serves as a reminder that the more info you can put into a post 
the more likely you are to get the help you need.

If the actual code snippet had been posted originally, it could have 
served to answer the guesses in the last couple of posts about whether 
there were trailing blanks or a syntactically valid command (and could 
have led to a quicker resolution for the OP).

Peter Relson
z/OS Core Technology Design

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[John McKown]

On Fri, Oct 23, 2015 at 6:22 AM, Terry Sambrooks <
terry_sambro...@btconnect.com> wrote:

> Hi
>
> I have resolved the issue I was having with MGCRE and it was nothing to do
> with security. I did try the WARN setting within RACF and I also
> experimented with RACROUTE (which is another story) but ultimately the
> problem lay with command length.
>
> Because the TEXT length on MGCRE can be up to 126 characters I defined an
> area of that size and left the length fixed. This worked OK for z/OS
> Commands, but it would seem that JES2 is more picky. By calculating the
> command length and storing it in the TEXT prefix area, the program is now
> working fine.
>

​That _is_ interesting. Thanks for posting what the problem was & the
solution. Seems strange that JES2 is sensitive to trailing blanks. But I
know some UNIX languages which are, such as the BASH shell (in some cases).



>
> Kind Regards - Terry
>
> Director
> KMS-IT Limited
> 228 Abbeydale Road South
> Dore
> Sheffield
> S17 3LA
> UK
>
>
-- 

Schrodinger's backup: The condition of any backup is unknown until a
restore is attempted.

Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Elardus Engelbrecht]

Terry Sambrooks wrote:

>I have resolved the issue I was having with MGCRE and it was nothing to do 
>with security. I did try the WARN setting within RACF and I also experimented 
>with RACROUTE (which is another story) but ultimately the problem lay with 
>command length.

Excellent! Just before your license expires at end of this month!


>Because the TEXT length on MGCRE can be up to 126 characters. I defined an 
>area of that size and left the length fixed. This worked OK for z/OS Commands, 
>but it would seem that JES2 is more picky. 

About JES2 being picky, hmmm, this is news for me, because I have my commands 
(on SVC 34, not MGCRE) fixed at 71 characters at maximum. I honestly can't 
remember why I settled on that short length, but JES2, RACF, z/OS, TCPIP, other 
STCs accepted all commands for my SVC 34.


>By calculating the command length and storing it in the TEXT prefix area, the 
>program is now working fine.

Interesting. I'm still busy with that MGCRE, but I got another more urgent work 
to do... I will remember your hint. Thanks and all of the very best for you!

Groete / Greetings
Elardus Engelbrecht

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Terry Sambrooks]

Hi

I have resolved the issue I was having with MGCRE and it was nothing to do
with security. I did try the WARN setting within RACF and I also
experimented with RACROUTE (which is another story) but ultimately the
problem lay with command length.

Because the TEXT length on MGCRE can be up to 126 characters I defined an
area of that size and left the length fixed. This worked OK for z/OS
Commands, but it would seem that JES2 is more picky. By calculating the
command length and storing it in the TEXT prefix area, the program is now
working fine.

Kind Regards - Terry
 
Director
KMS-IT Limited
228 Abbeydale Road South
Dore
Sheffield
S17 3LA
UK
 
Reg : 3767263
 
Outgoing e-mails have been scanned, but it is the recipients responsibility
to ensure their anti-virus software is up to date.
 
 


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[J R]

JES2 parsing of commands is not conducive to comments.  To include them on a 
command you have to use a /* ... */ construct.  

During parse, all blanks are removed, along with syntactically correct 
comments.  If what remains is not a syntactically correct JES command, it will 
not be executed.  

Is it possible you have been relying on at least one blank delimiting the 
command ahead of garbage "comments"?  
 

From: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> on behalf of 
Terry Sambrooks <terry_sambro...@btconnect.com>
Sent: Friday, October 23, 2015 7:22 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Using MGCRE with JES2 Commands

Hi

I have resolved the issue I was having with MGCRE and it was nothing to do
with security. I did try the WARN setting within RACF and I also
experimented with RACROUTE (which is another story) but ultimately the
problem lay with command length.

Because the TEXT length on MGCRE can be up to 126 characters I defined an
area of that size and left the length fixed. This worked OK for z/OS
Commands, but it would seem that JES2 is more picky. By calculating the
command length and storing it in the TEXT prefix area, the program is now
working fine.

Kind Regards - Terry

Director
KMS-IT Limited
228 Abbeydale Road South
Dore
Sheffield
S17 3LA
UK

Reg : 3767263

Outgoing e-mails have been scanned, but it is the recipients responsibility
to ensure their anti-virus software is up to date.




--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Shmuel Metz (Seymour J.)]

In
,
on 10/23/2015
   at 12:22 PM, Terry Sambrooks  said:

>Because the TEXT length on MGCRE can be up to 126 characters I
>defined an area of that size and left the length fixed. 

Trailing blanks?
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Neil Duffee]

Looking in from *way* outside, I wonder that the problem might *not* be 
security.  The message states simply there was a non-zero RC.  (Ok, security 
could cause that too.)

Does the MGCRE interface indicate which sub-system the command is to be 
directed to?  Perhaps it should only be D SPOOL without the sub-system 
identifier ($).  Alternately, could there be something in between ie. for SDSF, 
you use /$D SPOOL.

Again, n00b response to be ignored as such.

>  signature = 8 lines follows  <
Neil Duffee, Joe Sysprog, uOttawa, Ottawa, Ont, Canada
telephone:1 613 562 5800 x4585  fax:1 613 562 5161
mailto:NDuffee of uOttawa.ca http:/ /aix1.uOttawa.ca/ ~nduffee
"How *do* you plan for something like that?"  Guardian Bob, Reboot
"For every action, there is an equal and opposite criticism."
"Systems Programming: Guilty, until proven innocent"  John Norgauer 2004
"Schrodinger's backup: The condition of any backup is unknown until a restore 
is attempted."  John McKown 2015


-Original Message-
From: Terry Sambrooks [mailto:terr...sam...@btc...com] 
Sent: October 12, 2015 11:17
Subject: Re: Using MGCRE with JES2 Commands

In respect of "Please post the full IEE707I message and the command attempted." 
The reality is that ANY z/OS command is accepted but ANY JES2 command is 
rejected so if I use $DSPOOL as an example the message received
is:

IEE707I $DSPOOL NOT EXECUTED

If the program were not linked AC(1) it would SD22 which it does not. I am the 
security guy and as such own JES%.** which ought to give me access to commands 
which do not have an explicit profile, or so I thought. [snip]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Elardus Engelbrecht]

Terry Sambrooks wrote:

>I thought it would be good to update the program to use MGCRE. The update 
>works fine for z/OS Commands but any attempt to issue a JES2 command results 
>in that command being displayed on the hardcopy log together with IEE707I NOT 
>EXECUTED.

Please post the full IEE707I message and the command attempted.

Did you check your authority with your security guy/gal?

>The program does not do any RACROUTE processing as the MGCRE notes indicate 
>that if UTOKEN is not specified command processing will be linked to the 
>Address Space Userid.

This is true. Let z/OS (console and message processing) and JES2 worry about 
the A/S owner and authority.

Is your program linked AC(1)?

Binyamin Dissen suggestion about UTOKEN is a good one.

Groete / Greetings
Elardus Engelbrecht

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Terry Sambrooks]

Hi Elardus

In respect of "Please post the full IEE707I message and the command
attempted." The reality is that ANY z/OS command is accepted but ANY JES2
command is rejected so if I use $DSPOOL as an example the message received
is:

IEE707I $DSPOOL NOT EXECUTED

If the program were not linked AC(1) it would SD22 which it does not. I am
the security guy and as such own JES%.** which ought to give me access to
commands which do not have an explicit profile, or so I thought.

I am confused about the UTOKEN. If the manual says it is optional and that
the Address Space Userid will be used if it is not coded, and the Address
Space Userid is that of the security administrator and hence has SPECIAL
authority, are we saying that the manual is incorrect and that UTOKEN is
mandatory.

Kind Regards - Terry
 
Director
KMS-IT Limited
228 Abbeydale Road South
Dore
Sheffield
S17 3LA
UK
 
Reg : 3767263
 
Outgoing e-mails have been scanned, but it is the recipients responsibility
to ensure their anti-virus software is up to date.
 
 


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Elardus Engelbrecht]

Terry Sambrooks wrote:

>In respect of "Please post the full IEE707I message and the command 
>attempted." The reality is that ANY z/OS command is accepted but ANY JES2 
>command is rejected so if I use $DSPOOL as an example the message received is:

>IEE707I $DSPOOL NOT EXECUTED

Groan. Perhaps I should STFU, but then two more questions please: 

At what z/OS version are you?
Do you have any exits which validate commands issued to JES2?

I'll try to make a new version of my production program (called 'Commander') 
using SVC34 to use MGCRE and see what I can get.

I will come back to you... 


>If the program were not linked AC(1) it would SD22 which it does not. 

Of course. SD22 will confuse any newbies of course. ;-)


>I am the security guy and as such own JES%.** which ought to give me access to 
>commands which do not have an explicit profile, or so I thought.

I'm also a security guy trying to prevent others to play on my favourite toy. 
But no, seriously, I think there is something I perhaps omitted while trying to 
help you.


>I am confused about the UTOKEN. If the manual says it is optional and that the 
>Address Space Userid will be used if it is not coded, and the Address Space 
>Userid is that of the security administrator and hence has SPECIAL authority, 
>are we saying that the manual is incorrect and that UTOKEN is mandatory.

I will check that again. I am sure there is something we all missed. I have 
RTFM and am also confused... gr.

Groete / Greetings
Elardus Engelbrecht

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Terry Sambrooks]

Hi Elardus

In respect of "At what z/OS version are you?
Do you have any exits which validate commands issued to JES2?"

This is a standard ADCD system which is at z/OS 1.13 and there are no
command validation exits that I am aware of".

I would not want you to go to too much trouble on my behalf as my license
expires at the end of October and I will not be renewing it. I was only
trying to tidy some loose end before I switch the system off, and had
thought that somebody must have done this already and might be able to
provide a swift answer.

Thank you for you efforts.

Kind Regards - Terry
 
Director
KMS-IT Limited
228 Abbeydale Road South
Dore
Sheffield
S17 3LA
UK
 
Reg : 3767263
 
Outgoing e-mails have been scanned, but it is the recipients responsibility
to ensure their anti-virus software is up to date.
 
 


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Using MGCRE with JES2 Commands

[Binyamin Dissen]

You can hardcode a UTOKEN for whatever ID you wish.

On Sun, 11 Oct 2015 16:22:30 +0100 Terry Sambrooks
 wrote:

:>Hi
:>
:>I have a very old program which uses SVC 34 directly to execute z/OS and
:>JES2 Commands.
:>
:>I thought it would be good to update the program to use MGCRE. The update
:>works fine for z/OS Commands but any attempt to issue a JES2 command results
:>in that command being displayed on the hardcopy log together with IEE707I
:>NOT EXECUTED.
:>
:>The program does not do any RACROUTE processing as the MGCRE notes indicate
:>that if UTOKEN is not specified command processing will be linked to the
:>Address Space Userid. 
:>
:>I found a query relating to this issue in the Oct 2000 archive but it did
:>not appear to have any response. I am hoping that I am missing something
:>simple and any advice would be appreciated.

--
Binyamin Dissen 
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN