Protecting commands using file system security

1. Enter ZSYSG DISPLAY cp0gen3 to display the current state of the OPSEC tag. If the OPSEC option is set to OFF, complete the following steps:
   1. Enter ZSYSG ALTER opsec to set OPSEC to ON.
   2. Enter ZRIPL to perform a software IPL on the z/TPF system.
   Note: To set OPSEC to OFF, complete the following steps:

   1. Enter ZSYSG ALTER noopsec
   2. Enter ZRIPL to perform a software IPL on the z/TPF system.

1. Edit the base/filesys/include/i_prot.h file to create the table. Each entry in the table must have the format {command, subcommand, mode, user, group, actiontype}, where

   command

   specifies the 4-character command name (omit the Z action character).

   subcommand

   specifies the command parameter. You must specify the subcommand using the parameter abbreviation, or the minimum required characters to issue the command. If there is no command parameter, or if you want to protect the command and all parameters, enter NO_ENTRY in this field and SINGLEENTRY in the actiontype field.

   mode

   specifies the permission level required to issue the command.

   user

   specifies the user allowed to issue the command.

   group

   specifies the group allowed to issue the command.

   actiontype

   specifies whether the command has a single entry in the command protection tree or if it is a part of a group of entries.

2. To protect a command with no parameters or to protect a command and all parameters, specify NO_ENTRY in the subcommand field and SINGLEENTRY in the actiontype field. The following example shows an entry for the ZDCOR command:

   {"dcor", NO_ENTRY, 0755, "root", "bin", SINGLEENTRY},

3. To protect a specific command and parameter, do the following:
   1. Create a main entry for the command, specifying NO_ENTRY in the subcommand field and GROUPENTRY in the actiontype field.
   2. Create a secondary entry for the command parameter. Specify the name of the command in the command field, the parameter abbreviation in the subcommand field, and GROUPENTRY in the actiontype field. The following example shows an entry for the ZINET command with the di parameter specified.

      {"inet", NO_ENTRY, 0751, "root", "bin", GROUPENTRY},
      {"inet", "di",     0755, "root", "bin", GROUPENTRY},

{"dcor", NO_ENTRY, 0755, "root", "bin", SINGLEENTRY},
{"inet", NO_ENTRY, 0751, "root", "bin", GROUPENTRY},
{"inet", "di",     0755, "root", "bin", GROUPENTRY},
/*****************************************************/
/*  DO NOT REMOVE THE FOLLOWING LAST ENTRY!!!! THANKS    */
/*****************************************************/
{NO_ENTRY, NO_ENTRY, 0,   NO_ENTRY, NO_ENTRY,   0},
};