ACF2 rule for securing SDSF INPUT command

Products

• ACF2 - z/OS
• ACF2
• ACF2 - MISC

Issue/Introduction

What ACF2 rule can be used to secure the use of the SDSF INPUT (on/off) command used when viewing a job?

Resolution

Users that need access to the INPUT command need READ access to ISFCMD.FILTER.INPUT in the SDSF resource class.

Example rule:

$KEY(ISFCMD) TYPE(SDF)
 FILTER.INPUT UID(users_uid) SERVICE(READ) ALLOW

Example RECKEY command:

SET R(SDF)
RECKEY ISFCMD ADD( FILTER.INPUT UID(users_uid) SERVICE(READ) ALLOW)

Issue F ACF2,REBUILD(SDF) on all systems that share the ACF2 database for the rule change to take effect.

 

Additional Information

Additional SAF resource names and access levels for SDSF commands can be found in IBM documentation here: ISFPARMS vs RACF profiles