How can the IND$FILE program be protected in ACF2?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

The IND$FILE program can be protected in RACF. How can this protection be configured with ACF2 ?

The following is the RACF setup: 

RDEF PROGRAM IND$FILE UACC(READ) OWNER(xxxxxx)
DATA('THIS PROGRAM IS THE IBM UTILITY PROGRAM WHICH UPLOADS/DOWN-
LOADS DATA') AUDIT(ALL(READ))

RALT PROGRAM IND$FILE ADDMEM('SYS1.xxxxxx'/volname/NOPADCHK)
SETROPTS WHEN (PROGRAM ) REFRESH

 

Environment

z/OS

Resolution

If there is no resource rule for TYPE(PGM) in place, the following can be done to protect the IND$FILE program.

To allow all Users access to all Programs:
$KEY(********) TYPE(PGM)
UID(*) ALLOW

Then, to allow all Users beginning with 'USER1' access to IND$FILE, create the following (PGM) resource rule.

$KEY(IND$FILE) TYPE(PGM)
UID(USER1) ALLOW
UID(*) PREVENT

Please note, in the above example, ONLY user with UID USER1 will be allowed access to IND$FILE.
All other Users will be prevented from accessing IND$FILE by default.

Once the Resource rule is compiled and stored, make sure to run the ACF2 command,  F ACF2,REBUILD(PGM), to activate resource rule validation.