​Hello CARLa specialists,
I have to cleanup some general resources and until now I've done with:

1) Listing the resource: RL class profile-name ALL
2) Editing the dataset and adding the PE commands DEL automatically via CARLa:
PE profile-name ID(userid) CLASS(class) DEL
3) Now I have to delete the resource members and the command should be created automatically via CARLa:
RALT class  resource-profile   -
DELMEM( resources-member in group)      
4) Last step is to delete the resource class itself

I'll be happy if someone help me to create the 3 Carla script:
1) RL classes  class-profile ALL or AUTH
2) Build the PE class-profile CLASS(xxxxxx) DEL
3) Build RALT .....  DELMEM(....)
RALT class  class-profile     -
DELMEM(member, member,   ...)  

Many thanks for all/any help.


------------------------------
[Rachid B.] [Kebbi]
[Security Administrator]
[C&A]
[Düsseldorf/Germany]
------------------------------
​​

Um, if you have CARLa, then I'd believe you also have zSecure Admin (among other tools).
If you're trying to delete a bunch of profiles, why would you not take the simple route of displaying them all thru RA.R, for your Classname profile ** (EGN match), then from that list put a DD on the first line of them and a DD on the last line of them, let it churn for a bit, and it will provide you with all of the necessary commands to delete all of the profiles?  More specifically -- if you're planning on getting rid of all of the profiles, why do you need to delete all of the permits and all of the members in the grouping class before you delete the profiles?  Deleting the profiles will get rid of all of the permits and all of the members in the profile without you having to specifically delete them first.  I mean, you said you wanted to delete the resource class, so it's easy to delete the profiles, no CARLa necessary.  (Unless I'm misunderstanding your goal here...)

------------------------------
Scott Tietjen CISSP
------------------------------

Original Message:
Sent: Tue March 17, 2020 03:33 AM
From: Bachir KEBBI
Subject: Create PERMIT delete command, create RALT delmem,

​Hello CARLa specialists,
I have to cleanup some general resources and until now I've done with:

1) Listing the resource: RL class profile-name ALL
2) Editing the dataset and adding the PE commands DEL automatically via CARLa:
PE profile-name ID(userid) CLASS(class) DEL
3) Now I have to delete the resource members and the command should be created automatically via CARLa:
RALT class  resource-profile   -
DELMEM( resources-member in group)      
4) Last step is to delete the resource class itself

I'll be happy if someone help me to create the 3 Carla script:
1) RL classes  class-profile ALL or AUTH
2) Build the PE class-profile CLASS(xxxxxx) DEL
3) Build RALT .....  DELMEM(....)
RALT class  class-profile     -
DELMEM(member, member,   ...)  

Many thanks for all/any help.


------------------------------
[Rachid B.] [Kebbi]
[Security Administrator]
[C&A]
[Düsseldorf/Germany]
------------------------------
​​

Hi Bashir,
like Scott, it is not quite clear to me what exactly is the goal of your 3 CARLa sripts. If you simple want to delete a bunch of general resource profiles entirely, Scott's suggestion is indeed by far the easiest way to go. 
Also, using the interactive zSecure Admin user interface as suggested by Rob is a useful strategy.

However, when you want to delete permissions from ACLs and/or members from member lists more selectively, you might like these CARLa scripts:

1. List all profile in GCICSTRN class including ACL (owner, installation data, member list)

newlist type=racf                                                             
 select class=gcicstrn segment=base                                           
 sortlist key uacc acl /* owner instdata memlst */                                  
                                                                              
2. Selectively delete permissions for IDs SYSPROG and/or SYS1 from selected GCICSTRN profiles

newlist type=racf nopage retain dd=ckrcmd                                     
 define #acl(aclid) subselect acl(id(sysprog,sys1))                              
 select class=gcicstrn segment=base acl(id(sysprog,sys1))                     
 sortlist 'permit' key(0) 'class(' | class(0) | ') id(' | #acl(0) | ') delete'
                                                                              
3. Seletively delete member CEDA from the member list of selected GCICTRN profiles

newlist type=racf nopage dd=ckrcmd                                            
 select class=gcicstrn segment=base memlst=:CEDA                              
 sortlist 'ralter' class(0) key(0) 'delmem(CEDA)'                             ​

Notes:

• /*....*/ means comment in CARLa. Therefore the columns owner, installation data, and member list are currently not included in the generated report.
• NOPAGE suppress the printing of layout characteristics such as titles, column headers, and page numbers.
• DD=CKRCMD redirects the output of the CARLa to the CKRCMD work data set where the generate commands can be reviewed/edited, run, submitted, or saved (for later execution)
• RETAIN repeats the profile name in the generated commands when both SYSPROG and SYS1 are permitted on a single ACL.
• The DEFINE statement only selects (sub-selects) the ACL entries to SYSPROG and SYS1 so that permissions to other IDs are not deleted.
• The pipe (|) is used to suppress blanks that are otherwise automatically inserted by the SORTLIST statement. In the German code page, you should use the exclamation mark (!) instead of the pipe sign (|) to suppress blanks.
• If needed you can add more filters to the SELECT statement to select only the applicable profiles. For example added OWNER=RACFADM, you only generate RACF commands for GCICSTRN profiles that are owned by RACFADM.

I hope this helps. 





------------------------------
Tom Zeehandelaar
z/OS Security Enablement Specialist - zSecure developer
IBM
Delft
+31643351728
------------------------------

Original Message:
Sent: Wed March 18, 2020 04:31 AM
From: Scott Tietjen
Subject: Create PERMIT delete command, create RALT delmem,

Um, if you have CARLa, then I'd believe you also have zSecure Admin (among other tools).
If you're trying to delete a bunch of profiles, why would you not take the simple route of displaying them all thru RA.R, for your Classname profile ** (EGN match), then from that list put a DD on the first line of them and a DD on the last line of them, let it churn for a bit, and it will provide you with all of the necessary commands to delete all of the profiles?  More specifically -- if you're planning on getting rid of all of the profiles, why do you need to delete all of the permits and all of the members in the grouping class before you delete the profiles?  Deleting the profiles will get rid of all of the permits and all of the members in the profile without you having to specifically delete them first.  I mean, you said you wanted to delete the resource class, so it's easy to delete the profiles, no CARLa necessary.  (Unless I'm misunderstanding your goal here...)

------------------------------
Scott Tietjen CISSP

Original Message:
Sent: Tue March 17, 2020 03:33 AM
From: Bachir KEBBI
Subject: Create PERMIT delete command, create RALT delmem,

​Hello CARLa specialists,
I have to cleanup some general resources and until now I've done with:

1) Listing the resource: RL class profile-name ALL
2) Editing the dataset and adding the PE commands DEL automatically via CARLa:
PE profile-name ID(userid) CLASS(class) DEL
3) Now I have to delete the resource members and the command should be created automatically via CARLa:
RALT class  resource-profile   -
DELMEM( resources-member in group)      
4) Last step is to delete the resource class itself

I'll be happy if someone help me to create the 3 Carla script:
1) RL classes  class-profile ALL or AUTH
2) Build the PE class-profile CLASS(xxxxxx) DEL
3) Build RALT .....  DELMEM(....)
RALT class  class-profile     -
DELMEM(member, member,   ...)  

Many thanks for all/any help.


------------------------------
[Rachid B.] [Kebbi]
[Security Administrator]
[C&A]
[Düsseldorf/Germany]
------------------------------
​​

Original Message------

Um, if you have CARLa, then I'd believe you also have zSecure Admin (among other tools).
If you're trying to delete a bunch of profiles, why would you not take the simple route of displaying them all thru RA.R, for your Classname profile ** (EGN match), then from that list put a DD on the first line of them and a DD on the last line of them, let it churn for a bit, and it will provide you with all of the necessary commands to delete all of the profiles?  More specifically -- if you're planning on getting rid of all of the profiles, why do you need to delete all of the permits and all of the members in the grouping class before you delete the profiles?  Deleting the profiles will get rid of all of the permits and all of the members in the profile without you having to specifically delete them first.  I mean, you said you wanted to delete the resource class, so it's easy to delete the profiles, no CARLa necessary.  (Unless I'm misunderstanding your goal here...)

------------------------------
Scott Tietjen CISSP
------------------------------

You can easily run the RACF commands in a batch job, like so.
Go to SE.4 and select Action: queue commands.
Go to RA.R and enter an L line command in front of the profile.  This generates an RLIST or LISTDSD command.
Next clean up the profile by using D line commands.
Press F3 until you see the RACF commands.  These have not been executed, but queued in CKRCMD.
Issue SUBMIT to generate JCL.  SUBMIT then option 1 to View or 2 to Edit the job.

------------------------------
Rob van Hoboken
------------------------------

If for some reason you wish to keep the (now empty) grouping profiles, you could simply go to RA.R, specify the class name (and if you want, also the profile key/mask), hit Enter.  You see the profile(s), next enter an S in front of the profile you want to clean up, and you see the Access Control List (ACL) and the list of Members.  For entries you wish to delete, enter a D in front.  Hit Enter. 
If you have Confirmation selected in SE.4, you get a prompt for each entry.  You could also suppress these prompts by typing SET in the command line.  Individual PERMIT DELETE and RALTER DELMEM are issued.
Depending on the command Action mode in SE.4 and the SET panel, the commands are executed immediately, or written out to CKRCMD.

Also, if you wish to remove a whole grouping profile, just doing RDELETE is good enough.  This is requested with a D line command in front of the profile key.

------------------------------
Rob van Hoboken
------------------------------