Can Top Secret TSSINSTX Be Used To Stop DISP=OLD On A Critical Dataset?

Products

• Top Secret
• Top Secret - LDAP
• WEB ADMINISTRATOR FOR TOP SECRET

Issue/Introduction

Can the Top Secret installation exit (TSSINSTX) be used to read JCL and deny access to batch jobs that have DISP=OLD on a particular high level qualifier for a dataset and then deny access to jobs or fail jobs with this in the JCL? If yes, what portion of the exit should be used?

Environment

Release : 16.0

Component : CA Top Secret for z/OS

Resolution

TSSINSTX does not have any entry points where JCL statements are being passed through the exit. For the SUBMIT, POSTINIT, and RESOURCE checking, a PLIST is received with selected information in it, but not the JCL statement. It is possible in the installation exit to do DSN resource checks and see the ATTRIBUTES (READ, WRITE, CONTROL, etc..) but Top Secret has no way to differentiate between DISP=NEW, DISP=OLD, or DISP=MOD.

JES EXIT 4 and JES EXIT 54 both provide the ability to scan JCL and cancel JOBS, but keep in mind that a file can be DYNAMICALLY allocated using DISP=OLD programmatically without any JCL at all.

The BEST solution would be an OPS/MVS like product that would see the DEVICE contention message on the console and then have logic there on which JOBs to cancel or let run.

But the answer for Top Secret is no, this capability is not available.