RACF security bypassing for DFSMShsm commands

The previously discussed TSO commands can also be issued by using the operator console. DFSMShsm operator commands can be entered from the operator console or by a DFSMShsm-authorized user (a user who has received the DFSMShsm DATABASEAUTHORITY attribute) under TSO by using the HSENDCMD command. The command keywords of these DFSMShsm commands are identical to the corresponding TSO commands, except that the leading H of these commands is omitted. For example, for the TSO HDELETE command, the operator enters the DELETE command or the authorized TSO user enters the HSENDCMD DELETE command.

In general there is no RACF® checking for DFSMShsm commands using the operator console. Therefore, the number of DFSMShsm-authorized users should be limited. An installation can use the ISPF-supplied SVC to run authorized, thus providing a way to issue requests to DFSMShsm. If DFSMShsm TSO commands are issued by a user who runs MVS-authorized, no RACF checking is done. If RACF FACILITY class is being used to protect aggregates, a user ID representing the console user must be defined and authorized to the aggregate group profiles before issuing the ABACKUP or ARECOVER commands from a console, or processing fails.