Protection of specific service classes in a RESET command

Products

• Top Secret

Issue/Introduction

The following command is used to change the service class of work currently in execution:

 

RESET JOB01456,SRVCLASS=BATCHCLS

 

Is possible to protect the use of specific service classes in a RESET command?

Environment

Release : 16.0

Component : Top Secret for z/OS

Resolution

When the RESET command is issued to change a service class the security call generated does not contain the service class name so Top Secret will not be able to protect the use of specific service classes in a RESET command

 

 

Additional Information

If USER01 has the TRACE attribute and the SECTRACE control option is enabled in Top Secret the following command :

 

RESET USER01,SRVCLASS=BATCHCLS

 

generates the following SECTRACE data:

 

TSS-C-0000*USER01  USER01  T OPERCMDS2008 G/0400000000,0000000000

TSS-1 600000000000 00000000   T/8000040401        MVS.RESET 

 

CA Top Secret does not generate the security calls, only intercepts them. 

In this sectrace the security call generated by the system is for the resource OPERCMDS and the resource name MVS.RESET

The Service class (BATCHCLS) does not appear in the security call so it can not be protected by Top Secret.