GIM20703S/T With SMP/E Commands And Top Secret

Products

• Top Secret

Issue/Introduction

When running SMP/E commands, the following error message occurs:

GIM20703S/T cmd PROCESSING FAILED. THE COMMAND OR SERVICE ROUTINE IS NOT PROTECTED BY A SECURITY MANAGER.

Resolution

These SMP/E resources are not authorized by default. You must make the following administrative changes to allow access to the SMP/E functions.

The security calls are all in the IBMFAC class (IBM FACILITY class) and have the following resource name formats:

• GIM.CMD.command for the SMP/E commands, where "command" is the name of the current SMP/E command being attempted.
  
  For example:

  TSS PERMIT(acid) IBMFAC(GIM.CMD.APPLY) ACCESS(READ)

  for the APPLY command.
  
  
• GIM.PGM.program for the GIMZIP, GIMUNZIP or GIMIAP service routines, where "program" is the name of the service routine being processed. For example:
  
  

  TSS PERMIT(acid) IBMFAC(GIM.PGM.GIMZIP) ACCESS(READ)

  for the GIMZIP command.
  
  To secure the SMP/E commands, define them in CA Top Secret as a protected resource.
  
  Example:

  TSS ADD(owningacid) IBMFAC(GIM.)

  It is recommended to issue PERMITs for each SMP/E function.
  
  However, if you prefer to allow everyone access to these resources, you can issue PERMIT commands similar to the following::

  TSS PERMIT(ALL) IBMFAC(GIM.PGM.) ACCESS(READ)
  TSS PERMIT(ALL) IBMFAC(GIM.CMD.) ACCESS(READ)

  To identify all users that need specific functions permitted, add the SMP/E resource to the AUDIT record. This will log all accesses for that SMP/E
  resources. This will enable writing of future PERMIT commands at a more granular level.

  TSS ADD(AUDIT) IBMFAC(GIM.PGM.)
  TSS ADD(AUDIT) IBMFAC(GIM.CMD.)