AW: Re: Help with mount?

2015-11-18 Thread Peter Hunkeler

> Isn't that supposed to be; SUPERUSER.FILESYS.USERMOUNT not 
> SUPERUSER.FILESYS.MOUNT?




I wasn't aware of the USERMOUNT profile, I only ever looked at the latter. But 
from reading what the former allows, I'm having difficulties to see the 
difference between having READ on the former or the latter. Both seem to allow 
users to mount with NOSETUID.


--
Peter Hunkeler



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN


AW: Re: Help with mount?

2015-11-17 Thread Peter Hunkeler

> You can add MOUNT to your USERID which is easy or you can just submit a JOB
> to issue the MOUNT and UNMOUNT


He asked about the authority to do z/OS UNIX file system mounts and unmounts.


Mount authority is given when


a) the process doing the mount/unmount is running uid=0
b) the process doing the mount/unmount is running with an MVS userid that has 
been given READ or UPDATE permission to profile SUPERUSER.FILESYS.MOUNT in the 
UNIXPRIV class (RACF). READ allows mounts with NOSETUID attribute, only. UPDATE 
allows SETUID or NOSETUID.


See z/OS UNIX System Serives PLanning Guide for details on the various UNIXPRIV 
class profiles.


--
Peter Hunkeler

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN