ACF2/DB2 resource violation for DB2 plans ACF04056

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC

Issue/Introduction

ACF04056 ACCESS TO RESOURCE DSNKADB TYPE DPLN BY SY206 NOT AUTHORIZED

ACFRPTRV shows

    DATE     TIME        SOURCE   JNAME    LID      NAME                 DISP       REC SERV LOOKUP-KEY
PRE PST RMC INT FIN UID                       CPU  MODULE   KEY-MOD  DSP-MOD           REQUESTED RESOURCE
MLS     USER-SECLABEL RSRC-SECLABEL MODE   SRC     RRC      RSN             

19.290 10/17 15.48       SRC12345  JOB 45678    USER01    DOE JOHN       NO-REC   *VIO EXEC DPLN-DSNKADB
  0   0   8   0  16 ABC  XYZ USER01                SYSX          DIRECTRY    -             DPLN-DSNKADB
  RESOURCE NAME: DSNKADB                                                        

Rules tried.

set db2(pln) sysid(dsnk)                                          
 $KEY(DSNKADB) TYPE(PLN) SYSID(DSNK)                              
   UID(*) SERVICE(EXECUTE) ALLOW     

  $KEY(DSNKADB) TYPE(PLN) SYSID(DSNK)                              
  UID(ABC  XYZ USER01) SERVICE(BIND,EXECUTE) ALLOW       
  UID(*) SERVICE(EXECUTE) ALLOW                                   

 $KEY(DSNKADB) TYPE(PLN) SYSID(DSNK)                              
  UID(ABC  XYZ USER01              ) SERVICE(BIND,EXECUTE) ALLOW       
  UID(*) SERVICE(EXECUTE) ALLOW          

F ACF2,REBUILD(PLN),CLASS(D)

what is wrong??

 

Environment

Release : 16.0

Component : CA ACF2 Option for DB2

Resolution

The resource in the violation message is RESOURCE DSNKADB TYPE DPLN

ACF2/DB2 rules are of the format $KEY(name) TYPE(PLN) SYSID(sysid)

In this case the values are

$KEY(ADB) TYPE(PLN) SYSID(DSNK)

the resource in the message and in the ACFRPTRV entry includes the sysid - "DSNK" and the actual resource name - "ADB" specifying  $KEY(ADB) instead of $KEY(DSNKADB) would resolve the problem.