ACF2 FACILITY class resource BPX.SUPERUSER and SUPERUSER UID(0)
search cancel

ACF2 FACILITY class resource BPX.SUPERUSER and SUPERUSER UID(0)

book

Article ID: 52182

calendar_today

Updated On:

Products

ACF2 ACF2 - DB2 Option ACF2 for zVM ACF2 - z/OS ACF2 - MISC PanApt PanAudit

Issue/Introduction

Is having ACF2 access to the FACILITY class resource BPX.SUPERUSER equivalent to being defined as SUPERUSER UID(0)?

 

Environment

Release:
Component: ACF2MS

Resolution

An ACF2 logonid that has access to the FACILITY class resource BPX.SUPERUSER is not equivalent to being defined as SUPERUSER UID(0), it only allows the user to switch to SUPERUSER UID(0) status.

The IBM SHELL SU (Switch User) command lets users under OMVS switch to the identity of another user. If no ID is specified, the user switches to a superuser, UID(0). This can be used as an alternative to assigning a user UID(0). The difference is that a user that is defined as SUPERUSER UID(0) does not need to issue the SU command to switch to UID(0). This distinction is important because if a user is running an OMVS application, SCRIPT, REXX EXEC or program that requires UID(0) the SU command must be issued to switch to UID(0) in order to have SUPERUSER authority, and in some cases that is not possible. BPX.SUPERUSER FACILITY class may not be sufficient in all cases where UID(0) is required.

The ability to switch to superuser status is controlled through the FACILITY class resource BPX.SUPERUSER. To control which users have the ability to use the su command, add rule entries to the BPX FACILITY resources rule, similar to this one, as appropriate:

$KEY(BPX) TYPE(FAC)
SUPERUSER UID(user_uid) ALLOW

A user can be defined as SUPERUSER UID(0) by specifying UID(0) on the ACF CHANGE or INSERT logonid command or by specifying UID(0) on the INSERT or CHANGE command for the ACF2 PROFILE(USER) DIV(OMVS) record for the user.

 

Additional Information

Details on the BPX.SUPERUSER resource are taken from the online ACF2 documentation "Control Access to Superuser Status".