ACF2 rules for the IFASMF resources

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 - z/OS
• ACF2 - MISC

Issue/Introduction

This article documents how to setup ACF2 rules for IFASMF resources.

Resolution

The IFASMF resource is used to check authority to read the SMF log stream or in-memory resource.

With ACF2, resources do not need to be defined. All resources are protected by default.

The following provides details on setting up ACF2 rules for IFASMF resources.

Read the SMF Log Stream

You must give this user ID the READ authority to the profile that you set up to secure your SMF log stream or in-memory resource, where IFASMF.resource is the name of the SMF log stream or in-memory resource that is being used to capture SMF records 

PERMIT IFASMF.resource CLASS(LOGSTRM) ACCESS(READ) ID(userid) 

The ACF2 equivalent:

The default resource type for LOGSTRM is SAF. If you want to use a different type code, insert a GSO CLASMAP record as follows:

ACF
SET CONTROL(GSO)
INSERT CLASMAP.logstrm RESOURCE(LOGSTRM) RSRCTYPE(log)
F ACF2,REFRESH(CLASMAP)

Where log is the type code you select.

Sample ACF2 Rule:

ACF
SET RESOURCE(LOG)
RECKEY IFASMF ADD( resource UID(userid) SERVICE(READ) ALLOW)

* where userid is the UID string of the logonid accessing the resource.

Read the In-Memory Resource

PERMIT IFA.IFASMF.resource CLASS(FACILITY) ACCESS(READ) ID(userid) 

* where userid is the UID string of the logonid accessing the resource.

Sample ACF2 Rule:

ACF
SET RESOURCE(FAC)
RECKEY IFA ADD( IFASMF.resource UID(userid) SERVICE(READ) ALLOW)
F ACF2,REBUILD(FAC)

* where userid is the UID string of the logonid accessing the resource.

This call requires the FACILITY class to be made globally resident. Issue a SHOW RESIDENT command to verify the FAC type code is resident. If it is not, then it must be added to the INFODIR record.

Sample commands:

ACF
SET C(GSO)
CHA INFODIR TYPES(R-RFAC) ADD
F ACF2,REFRESH(INFODIR)