Does the ACF2/DB2 Option support DB2 v11 Global Variables?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC

Issue/Introduction

Question:  
Does the ACF2/DB2 Option support DB2 v11 Global Variables?

Answer:  
ACF2/DB2 support of DB2 v11 Global Variables was implemented with apar RO55265.

The updates for support of 'Global Variables' are as follow.

A new $TYPE code VAR for 'Global Variables' was added:

$TYPE(typecode) Specifies the type of DB2 resource that this rule set applies to. The type code groups CA ACF2 Option for DB2 rules so that they can be identified for a particular type of resource. The $TYPE control statement is required. This type code can be:

Type Code                  Description

BPL                        Buffer pools
COL                        Collections
CON                        Trusted contexts
DBS                        Databases
FNC                        Functions
JAR                        JAR files
PKG                        Packages
PLN                        Application plans
PRC                        Stored procedures
ROL                        Roles
SCH                        Schemas
SEQ                        Sequences
STG                        Storage groups
SYS                        System privileges and utilities
TBL                        Tables (and views)
TSP                        Table spaces
TYP                        Distinct types
VAR                        Gloabal Variable

The DB2 OPTS record VARMODE field was added:

Record ID        Fields                                                               

OPTS             ACTIVE|NOACTIVEGSYSID(1-4 character string-optional)

BPLMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

CONMODE          (ABORT|LOG|QUITE|RULE,norule,no$mode)

DBSMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

FNCMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

PLNMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

PRCMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

ROLMODE          (ABORT|LOG|QUITE|RULE,norule,no$mode)

SCHMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

SEQMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

STGMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

SYSMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

TBLMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

TSPMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

TYPMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

VARMODE          (ABORT|LOG|QUIET|RULE,norule,no$mode)

This example shows how to create a new OPTS record for the TEST DB2 subsystem. With this record, CA ACF2 Option for DB2 permits access to any resource but logs it. This example uses the REP parameter to insert new values into a DB2 OPTS record. This example shows how an INSERT subcommand might look when you enter it:

Sample INSERT:

INSERT OPTS SYSID(TEST) BPLMODE(LOG) CONMODE(LOG) DBSMODE(LOG) FNCMODE(LOG) -
PLNMODE(LOG) PRCMODE(LOG) ROLMODE(LOG) SCHMODE(LOG) SEQMODE(LOG) STGMODE(LOG) -
SYSMODE(LOG) TBLMODE(LOG) TSPMODE(LOG) TYPMODE(LOG) VARMODE(LOG)

The VARMODE 'Field Descriptions' were updated to include VARMODE.

The following OPTS record fields identify DB2 resource types and what CA ACF2 Option for DB2 recommends when a rule entry denies access to a resource type.

ACTIVE|NOACTIVE

Inserts the OPTS record before you actually implement CA ACF2 Option  for DB2 security. The default value is ACTIVE.

The following OPTS record fields identify DB2 resource types and what A ACF2 Option for DB2 recommends when a rule entry denies access to a resource type.

GSYSID

Specifies a one to four character string that will be used as the group SYSID. This field can be specified so that if multiple D2 subsystems have the same value for the group SYSID, all of the subsystems will use the same resource rules. The value of the group SYSID will be substituted as the SYSID() to match to resource rules when a validation is done.

BPLMODE  Buffer pool

CONMODE  Trusted context

DBSMODE  Database

FNCMODE  Function

PLNMODE  Application plan, package, or collection

PRCMODE  Stored procedure

ROLMODE  Role

SCHMODE  Schema

SEQMODE  Sequences

STGMODE  Storage group

SYSMODE  System privilege or utility

TBLMODE  Table or a view

TSPMODE  Table space

TYPMODE  Distinct type

VARMODE  DB2 global variables

 The ACF2/DB2 documentation of the 'Privileges' table was updated to include the SERVICEs READ and WRITE that can be associated with 'Global Variables'.

Writing ACF2/DB2 TYPE(VAR) rules for 'Global Variables'

Syntax for TYPE(VAR) Rules:  

   $KEY(RESOURCENAME) 

   $TYPE(VAR)
   $SYSID(SYSIDMASK)
   <$NOSORT>
   <$USERDATA('TEXT')>
   <$ROLESET>
   <$LIDOWNER(LOGONID)|$UIDOWNER(UIDMASK)|$ROLOWNER(ROLE)>
   <$MODE(ABORT|LOG|QUIET)>
   <%CHANGE UID-MASK1,UID-MASK2,...,UID-MASKN|LOGONID1,...LOGONIDN>
   <%RCHANGE UID-MASK1,UID-MASK2,...,UID-MASKN|LOGONID1,...LOGONIDN>
   <UID(UIDMASK)>
   <USER(LOGONID)>
   <ROLE(ROLE)>
   <SHIFT(SHIFT)>
   <UNTIL(DATE)|FOR(DAYS)>
   <SERVICE(KEYWORD1,,...KEYWORDN)> **
   <DATA('TEXT')>  
   <ALLOW|LOG|PREVENT>
   <*COMMENT>        

** Note Global Variables resource rule SERVICE can be READ or WRITE.

Example TYPE(VAR) rule

Enter the $KEY on the first line. You can also enter the $TYPE and $SYSID control statements on this line if you prefer. Enter the other control statements and then rule entries, each on a separate line. Press ENTER or RETURN after each line. To end the rule set, enter a blank line. A message displays:

acf
ACF
set db2(var)
DB2
compile
ACFD2010 DB2 COMPILER ENTERED

. $key(global.variable) type(var) sysid(prod)
. uid(tfinpayiso) service(read) allow
. uid(tfinadmiso) service(write) until(11/24/05) log
.

ACFD2051 TOTAL RECORD LENGTH= 210 BYTES, 5 PERCENT UTILIZED
DB2             

 

Environment

Release: ACF2DB00200-1.3-ACF2-Option for DB2
Component:

Resolution

-