ACF2 PDS member-level protection bypassed for UPDATE access with CA-PDSMAN

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

I have a problem with the ACF2 "Member-Level Protection" .... Calls to security are always done for READ access but never for UPDATE access.

A CAS4TRCE (tracing member-level validations) and a SECTRACE show no calls to ACF2 for UPDATE, even though the PDS member has been updated.

The PDS is controlled by CA-PDSMAN.

 

 

 

Environment

Release:
Component: ACF2MS

Resolution

The CA-PDSMAN parameter FASTSTOW=Y is incompatible with ACF2 PDS member-level protection.

With FASTSTOW=Y, PDSMAN intercepts the STOW (UPDATE) and handles it.

The STOW is not passed on so ACF2 never sees it. Consequently, there is no ACF2 validation for the UPDATE and access is allowed.

If full support for the PDS member-level feature is required, then the PDS must not be controlled by CA-PDSMAN or FASTSTOW must be set to N.