IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

HOWTO :Authorization checking for access control to data sets WHEN using ÏSPEXEC EDIT

  • 1.  HOWTO :Authorization checking for access control to data sets WHEN using ÏSPEXEC EDIT

    Posted 11/26/19 12:52 PM
    Hi,

    I am using a REXX application, and want to allow access to specific datasets only from within this rexx.

    I was thinking about using WHEN(PROGRAM( )) .

    I am using "ISPEXEC EDIT DATASET(.......)" to access the DS.

    Anyone knows if this is possible, and when yes...how to define this in RACF.

    Kind Regards,

    peter

    ------------------------------
    Peter Karel
    ------------------------------


  • 2.  RE: HOWTO :Authorization checking for access control to data sets WHEN using ÏSPEXEC EDIT

    Posted 11/27/19 04:07 AM
    Conditional access, or Program Access to Data Sets (PADS), relies on a clean execution environment.  That means, no other executables may be running while (and before) the controlled program is started.  In TSO this implies the controlled program is run in a separate TCB while the calling TCB is marker non-dispatchable.  This makes it difficult (read: impossible) to use ISPF dialog services from a controlled program.
    A controlled program, that can be used in a conditional access list, must be a load module.  A Rexx program is not a a "load module" and can not be used as the basis for program control, unless you compile it into a load module.  And even then, ISPF services are out of the question.
    If you wish to implement a controlled data access path using PADS, you would have to concentrate the data set access (OPEN, READ/WRITE and CLOSE) into a separate load module, call this load module from your Rexx (remembering that you cannot use ISPF dialog services).
    It is probably easier and inherently safer to build a service address space (started task), running under a service user id, that provides data set access services, and communicate from your Rexx program using sockets.

    ------------------------------
    Rob van Hoboken
    ------------------------------



Related Content