Protecting commands using RACF

You can allow RACF to control commands that are issued. Protect commands by creating a profile named with the subsystemID.command format.

Example

For a subsystem named MBOS, create the following profiles:

Protect all commands that are issued from the subsystem by creating a profile named MBOS.*.
Protect only the SHUTDOWN command by creating a profile named MBOS.SHUTDOWN.

For the STATUS command, the required RACF authority is READ. All other commands require an authority of CONTROL. All pertinent RACF rules apply.

Commands can have one of the following states:

RACF is not protecting the command.
RACF is not active, OPERCMDS is not active, or a profile does not cover the command.
RACF is protecting the command.
- The profile allows user access to the command.
  OPERCMDS is active, a profile covers the command, and the user has sufficient authority to the command. Processing continues normally.
- The profile disallows user access to the command.
  OPERCMDS is active, a profile covers the command, and the user does not have the required authority. Processing halts, and an unauthorized error message is displayed.

Comments