IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  UNIX=NO

    Posted 01/15/20 01:52 PM
    Hello everyone,  

    My name is Richard, I am a college student that is new to the mainframe world and zSecure.  I am eager to learn more about zSecure and mainframes so all advice is welcome. Especially any training like what was linked in Coreen Ryskamp post "Free training." As a college student, anything free is greatly appreciated!

    I am working on TSS (Top Secret) and there is a problem with the creation of Ckfreeze file's on a couple of LPAR's. The error message we are getting is denying us read access to Unix directories across the lPAR's (even though we are on shared DASD). Within the Ckfreeze file parameters, we have the UNIX=NO specified which solved that problem. However, now we are getting an error code CKR2226. To our knowledge this means we need to have  another Ckfreeze file that has the SHARE=YES within the parameters. We do have this option on another LPAR that shares a security data set with the same LPAR I was running into the Unix directory issues + CKR2226. 

    Any advice on what might be causing this? The odd thing is that we are not running into permissions errors (read access denied) on the LPAR that shares a security dataset with LPAR that IS denying us read access. Same ACID and profile permissions on both LPAR's.

    ------------------------------
    Richard Shimandle
    richard.shimandle@equifax.com
    Big Iron Apprentice
    (470)-233-9031
    ------------------------------


  • 2.  RE: UNIX=NO

    Posted 01/15/20 02:16 PM
    CA-TopSecret does not use the same API as RACF when CKFCOLL needs to change UID.  The work around in CA-TSS is to grant UID(0) to the user that runs CKFCOLL.

    ------------------------------
    Rob van Hoboken
    ------------------------------