IMS commands are getting ACF2 violations but are still being allowed.

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

A user entered an IMS command that should not be allowed according to the rules. 
ACF2 did show a violation in the IMS joblog, but the command still processed and shut down the IMS region causing an outage.

ACF04056 ACCESS TO RESOURCE CHECKPOINT TYPE RCMD BY userid NOT AUTHORIZED

How can this be rectified ?

Environment

Release:
Component: ACF2MS

Resolution

IBM distributes a command security exit with IMS called DFSCCMD0. 
The default exit will override the ACF2 response to deny access with an ALLOW. 
Remove / disable the exit if ACF2 validation is required to be implemented.