Updating an existing SDSF security setup

Products

• ACF2 - z/OS

Issue/Introduction

An existing ACF2 SDSF setup on a non-production system is to be updated to allow everyone all access to SDSF.  Recommendations on accomplishing the update are needed.

 

Environment

Release : 16.0

Resolution

1) Before considering any changes, these two ACF commands should be issued to see what definitions are already in place:

SHOW SAFDEF
and
SHOW CLASMAP

2) To show all existing resource rules for SDSF, the following ACF2 commands must be issued for all 5 type codes in the resource rules below: 

From the TSO, ACF prompt (or in ACFBATCH):

Set r(xxx)           where xxx is the  type code shown in the below resource rules. 
List like(-)

3) To ensure all SDSF resources are allowed to everyone, only a single masked rule [ KEY(********)  and UID(*)  ]  is needed for each resource type. Note The KEY value is 8 asterisks.

$KEY(********) TYPE(SDF)
- UID(*) ALLOW

$KEY(********) TYPE(XFC)
- UID(*) ALLOW

$KEY(********) TYPE(SPL)
- UID(*) ALLOW

$KEY(********) TYPE(WTR)    
- UID(*) ALLOW

$KEY(********) TYPE(OPR)
- UID(*) ALLOW  

NOTE: As these KEY values are masked there must be an entry in INFODIR for the type codes. 

- If the resource type has already been included in the GSO INFODIR record, the user will get the message  

ACF60039 ISSUE THE F ACF2,REBUILD(typecode) COMMAND TO ACTIVATE THE RULE  

when the rule is compiled and stored. 

- If the resource type is not currently in the INFODIR record, then the INFODIR record will have to be updated to add the rule's type code before the REBUILD command can be issued. These commands accomplish the change and activation: 

      set c(gso)  
      change infodir types(r-rxxx) add  
      f acf2,refresh(infodir)  
      f acf2,rebuild(xxx). 

NOTE the REBUILD must be done for each xxx type added to the INFODIR record.

 

Additional Information

Using SAF for SDSF External Security