Would integrity be compromised somehow more by (from
my simplistic thinking) if I have a non-APF member in
JOBLIB/STEPLIB and the system fails the job with a S306
than it would be compromised by bypassing the non-APF module
and loading and executing the same-named module from APF/LNKLST?
You
/or explained to me
before, so I thank you for that info.
Rex
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Peter Relson
Sent: Saturday, December 21, 2013 10:28 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization
Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Jim Mulder
Sent: Friday, December 20, 2013 2:43 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
I stand 'slightly' corrected. Module SS14RC02 isn't in a LNKLST
library, it is in the LPA. Module
design decisions
were forced by those constraints, also.
Bill Fairchild
Franklin, TN
- Original Message -
From: Rex Pommier rpomm...@sfgmembers.com
To: IBM-MAIN@LISTSERV.UA.EDU
Sent: Monday, December 23, 2013 1:50:52 PM
Subject: Re: APF authorization and JOBLIB DD card
Peter
At 20:05 + on 12/23/2013, DASDBILL2 wrote about Re: APF
authorization and JOBLIB DD card:
I suspect that using the STEPLIB or JOBLIB mutually exclusively
within one step was influenced heavily by the cost of core way
back when the TCB and the initiator were being designed, maximum
On Mon, 23 Dec 2013 16:22:56 -0500, Robert A. Rosenberg wrote:
If you REALLY want to fall back to JOBLIB if you do not find the
module in STEPLIB, you can just add the libraries that are in JOBLIB
but not in STEPLIB to the end of the STEPLIB concatenation. Changing
the search order to not
You mention below that the way MVS loads APF modules (bypassing an
unauthorized JOBLIB/STEPLIB module to load the same-named module
from an APF library in the LNKLST) is needed for system integrity.
Would integrity be compromised somehow more by (from my simplistic
thinking) if I have a
begin extract from extract
The directory is located on DASD with the data set, and is updated
whenever the module is changed. The directory entry contains
information about the module and where it is located in storage.
/end extract from extract
which is at best misleading. The data-set
Does RMODE=ANY really provide useful information about where to find a
copy of a load module or program object that has been brought into
storage?
I think not. I do of course concede, if that is the right word, that
RMODE=24 is more helpful.
John Gilmore, Ashland, MA 01721 - USA
On Fri, 20 Dec 2013 12:29:52 -0500, Jim Mulder wrote:
...
That is correct, and that's why I suggested that a dump may be
useful. We would also like to see the results from the
following commands:
SETPROG LNKLST,TEST,NAME=CURRENT,MOD=SS14RC02
D PROG,LNK
Most useful here would be an
On Thu, 19 Dec 2013 00:58:00 +, Blaicher, Christopher Y. wrote:
Because the search is STEPLIB first, JOBLIB second (or first if no STEPLIB) ...
Really? I thought that JOBLIB was ignored if there is a STEPLIB.
--
Tom Marchant
Tom,
You are correct, if the STEPLIB exists, the JOBLIB is ignored.
Rex
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Tom Marchant
Sent: Friday, December 20, 2013 7:49 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization
@LISTSERV.UA.EDU] On Behalf
Of Tom Marchant
Sent: Friday, December 20, 2013 8:49 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
On Thu, 19 Dec 2013 00:58:00 +, Blaicher, Christopher Y. wrote:
Because the search is STEPLIB first, JOBLIB second (or first
in storage.
Thanks
Lizette
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of Blaicher, Christopher Y.
Sent: Friday, December 20, 2013 7:12 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
You
: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of Blaicher, Christopher Y.
Sent: Friday, December 20, 2013 7:12 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
You are correct.
Chris Blaicher
Principal Software Engineer, Software
Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of Mark Jacobs
Sent: Friday, December 20, 2013 7:25 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
From the JCL Reference manual;
13.3.5 Relationship of a STEPLIB to a JOBLIB
The last time I looked at the text Lizette quotes was a long time ago,
and its current version contains the subtext
begin extract from extract
The directory is located on DASD with the data set, and is updated
whenever the module is changed. The directory entry contains
information about the
On Fri, 20 Dec 2013 07:28:49 -0700, Lizette Koehler wrote:
Thanks. That explains the confusion. In the JCL manual it says ignore,
however in the INIT and TUNING, it does not clearly state it is ignored.
I will do some testing.
I was always told STEPLIB then JOBLIB without any qualifications.
On Fri, 20 Dec 2013 09:34:15 -0500, John Gilmore wrote:
The last time I looked at the text Lizette quotes was a long time ago,
and its current version contains the subtext
begin extract from extract
The directory is located on DASD with the data set, and is updated
whenever the module is
stops if the module is found in the STEPLIB
Lizette
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of John Gilmore
Sent: Friday, December 20, 2013 7:34 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD
Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of John Gilmore
Sent: Friday, December 20, 2013 7:34 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
The last time I looked at the text Lizette quotes was a long time ago
On Fri, 20 Dec 2013 00:38:57 -0600, Elardus Engelbrecht wrote:
Pommier, Rex wrote:
Since I'm the OP, here is the detail of what has me so confused. [ ...
snipped ... ]
I'm also confused, but before you follow Jim Mulder's recommendation, could
you perhaps reread in 'MVS Initialization and
Koehler
Sent: Friday, December 20, 2013 7:51 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
And the other question is
If I have a STEPLIB and a JOBLIB and the module I need is only in the JOBLIB,
would not the step with the STEPLIB looking for that module fail
On 12/20/2013 6:28 AM, Lizette Koehler wrote:
I was always told STEPLIB then JOBLIB without any qualifications.
This was discussed in another thread just last month. TCBJLB contains
zero or points to an open DCB for either JOBLIB or STEPLIB -- not both.
--
Edward E Jaffe
Phoenix Software
OIDEBFLGS1,DEBAPFIN TURN ON APF LIBRARY BIT
If you have enough control over your system not to have to worry about
this blatant system integrity exposure, then why would you not just make
the data set APF authorized?
ADRNAPF
Regarding ADNAPF(64), yes they exist. And if you don't know
On 12/20/2013 7:22 AM, Peter Relson wrote:
Does it matter, for the purpose of this discussion, that if the module
exists both in (unauthorized) joblib/steplib and the lnklst, the fetch
will succeed? For LNKAUTH=LNKLST, the only time you get the 306 is
when the module exists only in an
On Fri, 20 Dec 2013 07:51:12 -0800, Ed Jaffe wrote:
I used to erroneously believe CSV would abend306 immediately when it
found an unauthorized (spoofed?) copy, and years later discovered (the
hard way - surely my fault for not reading the book carefully enough)
that it simply ignores them until
On 12/20/2013 8:00 AM, Paul Gilmartin wrote:
On Fri, 20 Dec 2013 07:51:12 -0800, Ed Jaffe wrote:
I used to erroneously believe CSV would abend306 immediately when it
found an unauthorized (spoofed?) copy, and years later discovered (the
hard way - surely my fault for not reading the book
Your RCF? Yes.
To the contention that RMODE is something of an indicator of [loaded]
location in virtual storage my response would be that it is a quondam
indicator, but that providing support for the the value RMODE=ANY
emptied it of any such indicative content.
About JOBLIB and STEPLIB usage
?
Rex
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Peter Relson
Sent: Friday, December 20, 2013 9:23 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
Job 5: RC=0
It is extremely unlikely
The way I'm reading your explanation below, if I have program ABCDE
that needs to run APF authorized, and it is sitting both in the
LNKLST and in an unauthorized JOBLIB/STEPLIB, the system will skip
loading the unauthorized module from STEPLIB and load the authorized
version from LNKLST?
: Friday, December 20, 2013 11:30 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
The way I'm reading your explanation below, if I have program ABCDE
that needs to run APF authorized, and it is sitting both in the
LNKLST and in an unauthorized JOBLIB/STEPLIB
I stand 'slightly' corrected. Module SS14RC02 isn't in a LNKLST
library, it is in the LPA. Module SS14A32 is in the LNKLST and
that's the module my job abended on in my second attempt.
I just got off the phone with SyncSort support and worked through
the issue. While it doesn't
Discussion List IBM-MAIN@LISTSERV.UA.EDU
Date: Fri, 20 Dec 2013 15:43:07
To: IBM-MAIN@LISTSERV.UA.EDU
Reply-To: IBM Mainframe Discussion List IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
I stand 'slightly' corrected. Module SS14RC02 isn't in a LNKLST
of code from other callers in other
address spaces.
Kenneth
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of Gerhard Postpischil
Sent: Thursday, December 19, 2013 12:57 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization
by APF authorizing the JOBLIBS first , and then tried
another run by adding an unauthorized library to the JOBLIB concatenation .
TIA ,
Bob
Date: Thu, 19 Dec 2013 00:58:00 +
From: cblaic...@syncsort.com
Subject: Re: APF authorization and JOBLIB DD card
To: IBM-MAIN
On Thu, 19 Dec 2013 21:21:01 +0530, Robert Hahne wrote:
Hello Chris ,
This is a very good explanation . But that still leaves OP's last question
If IDCAMS requires APF authorization for called modules, why does IDCAMS work
when the JOBLIB is supposedly not authorized by introducing a
...@syncsort.com
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Robert Hahne
Sent: Thursday, December 19, 2013 10:51 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
Hello Chris ,
This is a very good
Gil,
Like Jim, we call IDCAMs from a STC and we had to be APF authorized we process
define/deletes for aliases...
Scott ford
www.identityforge.com
from my IPAD
'Infinite wisdom through infinite means'
On Dec 19, 2013, at 1:02 PM, Jim Mulder d10j...@us.ibm.com wrote:
It's possible that
-3803
E: cblaic...@syncsort.com
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of Robert Hahne
Sent: Thursday, December 19, 2013 10:51 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: APF authorization and JOBLIB DD card
Hello Chris
Since I'm the OP, here is the detail of what has me so confused.
Sorry for the length of the post, but it's the only way to show why
I'm befuddled. I read your first post talking about the APF versus
LINKLIST versus JOBLIB and I agree with you - that was/is how I
understood APF to work.
Pommier, Rex wrote:
Since I'm the OP, here is the detail of what has me so confused. [ ... snipped
... ]
I'm also confused, but before you follow Jim Mulder's recommendation, could you
perhaps reread in 'MVS Initialization and Tuning Guide' these two parts:
'Placing Modules in the System's
On Wed, 18 Dec 2013 23:06:40 +, Pommier, Rex wrote:
Why is IDCAMS demanding that non-APF module SS14RC02 be loaded from an APF
authorized library?
I know this one! From MC:
17.21 CSV019I
CSV019I REQUESTED MODULE mod NOT ACCESSED, IS IN NON-APF
LIBRARY/CONCATENATION
I will answer the APF questions, but I strongly suggest that you call SyncSort
Support in the morning if you continue to have ABEND 306 problems.
The short answer is that any module loaded by an authorized program must come
from an authorized library. Loaded modules don't have to be authorized
I'm confused - again. I thought I knew how APF authorization works
with JOBLIB statements but apparently I don't. Here's the
background. I'm installing a new maintenance level of SyncSort.
According to the SyncSort manual, the only library that needs APF
authorization is the SYNCAUTH
On 12/18/2013 7:58 PM, Blaicher, Christopher Y. wrote:
The short answer is that any module loaded by an authorized program
must come from an authorized library. Loaded modules don't have to
be authorized (AC=1), they just have to come from an authorized
library. Now it gets more complicated.
46 matches
Mail list logo
