TSS ADD(dept) VOL(*ALL*(G)) Automatically Protect All Volumes?

Products

• Cleanup
• Datacom
• DATACOM - AD
• CIS
• COMMON SERVICES FOR Z/OS
• 90S SERVICES
• DATABASE MANAGEMENT SOLUTIONS FOR DB2 FOR Z/OS
• COMMON PRODUCT SERVICES COMPONENT
• Common Services
• CA ECOMETER SERVER COMPONENT FOC
• Easytrieve Report Generator for Common Services
• INFOCAI MAINTENANCE
• IPC
• UNICENTER JCLCHECK COMMON COMPONENT
• Mainframe VM Product Manager
• CHORUS SOFTWARE MANAGER
• CA ON DEMAND PORTAL
• CA Service Desk Manager - Unified Self Service
• PAM CLIENT FOR LINUX ON MAINFRAME
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
• GRAPHICAL MANAGEMENT INTERFACE
• WEB ADMINISTRATOR FOR TOP SECRET
• Xpertware
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

Question:

Does TSS ADD(dept) VOL(*ALL*(G)) automatically protect all volumes?

Answer:

Owning VOL(*ALL*(G)) does not automatically define/protect all volumes. It allows VOL(*ALL*(G)) to be permitted.

Sites that don't want volume checking issue

TSS PERMIT(ALL) VOL(*ALL*(G)) ACC(CREATE)

so security defers to dataset checking regardless of what access the user is trying to get to the dataset.

NOTES:

1. Only the MSCA can own VOL(*ALL*(G)).
   
   
2. For sites that want all volumes protected even if they are not owned, set the DEFPROT attribute on the VOLUME resource class via:

   TSS REPLACE(RDT) RESCLASS(VOLUME) ATTR(DEFPROT) 

   CAUTION: Be very careful about setting DEFPROT on the VOLUME resource class because there may be undefined volumes where access is currently allowed that will fail with DEFPROT set.

 

Additional Information:

Please see chapter 12 of the CA Top Secret User Guide 'Protecting Resources', section titled 'Volume Protection' or more information on volume security.

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component: