Defining security authorizations

Edit online

To use an external security product, such as RACF, ACF2, or Top Secret, define the started task name to the security product and authorize the data set.

Procedure

To define the server and other required permissions for your security product, customize the appropriate security option located in the hlq.SAVZCNTL library, and submit the job:

AVZRAVDB is for IBM Resource Access Control Facility (RACF) security.
AVZA2VDB is for CA ACF2 (Access Control Facility) security.
AVZTSVDB is for CA Top Secret Security (TSS).

Results

The following table summarizes the access requirements by data definition name:

Table 1. Access requirements by data definition name
Data definition name	Access	Data set name
STEPLIB	READ, EXECUTE	`hlq`.SAVZLOAD
AVZRPCLB	READ, EXECUTE	`hlq`.SAVZRPC
SYSEXEC	READ	`hlq`.SAVZEXEC
TRACE	READ, WRITE	`hlq`.TRACE
AVZCHK1	READ, WRITE	`hlq`.SYSCK1
AVZMAPP	READ, WRITE	`hlq`.SAVZMAP. The user id and the server id should have the access to this dataset.

Make sure that your z/OS Security Administrator reviews the security definitions. You might need to change definitions to meet requirements at your site.