Guidelines for changing or deleting an ACEE

Delete only an ACEE that you created. Issuing a RACINIT with ENVIR=DELETE specified to delete the existing ACEE can lead to problems if you are not the one who created that environment. The issuer of the ENVIR=CREATE that built the ACEE might have saved a pointer to it and might be expecting it to be available later in processing. Note that this is the case for the initiator's ACEE. Also, if you delete an ACEE, you might lose tables anchored off that ACEE that are needed later in RACF® processing. See z/OS Security Server RACF Diagnosis Guide for overview diagrams of ACEEs and related control blocks that can be useful when diagnosing problems.

Note: When you delete an ACEE that has a third-party ACEE attached, the RACINIT pre- or post-exits get control again for the third-party ACEE as well as for the original ACEE being deleted.

If you make a copy of the ACEE and update fields, avoid passing it to RACHECK or RACDEF. These services anchor tables off the ACEE and refresh these tables when required. If you update fields in a copy, the original ACEE then contains incorrect pointers that result in abends when the original is used or deleted.

If you need to delete or change an ACEE that you did not create, you can use one of the following methods.

Save and restore the current ACEE pointers:
1. Save the current ACEE pointers from ASXBSENV and TCBSENV.
2. Clear ASXBSENV and TCBSENV.
3. Issue RACINIT ENVIR=CREATE.
4. At the end of processing,
  1. Issue ENVIR=DELETE
  2. Restore ASXBSENV and TCBSENV to the original values.
Change the values in the current ACEE:
- Issue RACINIT with ENVIR=CHANGE to change the values in the current ACEE.
Create, anchor, and delete a third-party ACEE:
- Issue RACHECK with USERID= and GROUPID= causing RACF to create, anchor, and delete a third-party ACEE internally.