Stellar Gil and very much appreciated
Scott ford
www.identityforge.com
On Sep 5, 2012, at 6:02 PM, Paul Gilmartin <paulgboul...@aim.com> wrote:
> On Wed, 5 Sep 2012 14:05:10 -0700, Scott Ford wrote:
>
> Your right IRXJCL is unauthorized. I assume the LINKMVS is an ATTACH another
> subtask ...
> So that the authorization would be that of the Task initiator , am I close..
>
> (Why don't I get quotation indicators (">") when I quote your text?)
>
> I believe (others here will know far better than I) that:
>
> o LINKMVS does a LINK SVC; ATTCHMVS does an ATTACH SVC. (But
> that's mostly a guess.)
>
> o If you link (as in IEWBLINK) IRXJCL with your STC code (the only way
> the CALL you mentioned can work) the AC of the ensemble is controlled
> by your Binder input.
>
> o If an authorized task LINKs or ATTACHes a load module from an
> authorized load library it retains its authorized status even if the
> child module was linked AC=0. (If it loads a module from an
> unauthorized library an ABEND results.)
>
> o If you are running IRXJCL authorized, you (and your customers)
> must control the JCL of the authorized task so no intruders become
> part of your SYSEXEC concatenation. Content supervision doesn't
> help you here as it does with load modules.
>
> o Likewise, you (and your customers) must control UPDATE access
> to any library in that SYSEXEC concatenation as strictly as if it
> were an authorized load module library.
>
> Is that too much or too little?
>
> On Wed, 5 Sep 2012 14:14:27 -0400, Shmuel Metz (Seymour J.) wrote:
>>
>>> Yep Walt is right for sure, I have called IRXJCL rexx clist and done
>>> a LINKMVS to an authorized RACF program , works like a champ
>>
>> Interesting, given that the manual expl;icitly states that LINKMVS et
>> all are for unauthorized programs.
>>
> If Rexx were abruptly to start enforcing this as law, the galaxy would
> collapse into a black hole. At least it would be as profound as the
> USERKEYCSA=NO transition.
>
> -- gil
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
