IOCDS considerations

Planning considerations contains a very thorough discussion of I/O configuration-related topics. It should be read in its entirety before reading the following security considerations.

When the IOCDS does not specify any sharing, I/O devices are owned solely by the logical partitions that own the channel paths that are attached to them. Even if a channel path has been designated as reconfigurable, that channel path cannot be removed from a logical partition unless the channel path has first been taken offline from within that logical partition. For z/OS® System Control Program (SCP) partitions, this is done with the SCP operator command CONFIG (CF). For partitions containing other SCPs, the Channel Operations task list must be used. Use the Configure Channel Path On/Off task to configure channel paths that are online. Use the Release I/O Path task to release the channel paths that are assigned to logical partitions that have the Logical Partition Isolation security control enabled or, use the Reassign I/O Path task to reconfigure a CHPID in one step.

I/O sharing should never be allowed for Isolated logical partitions. If the IOCDS were to specify I/O sharing, it would be indicated in the Input/Output Configuration Program's Configuration Reports (see the Input/Output Configuration Program User's Guide for ICP).

Isolated logical partitions must never define channel paths as shared in the IOCDS. Specification of a shared channel path can compromise the security of the Isolated logical partitions in the installation. A shared channel path is defined by specifying one of the following on the CHPID statement:

• SHARED keyword
• NOTPART keyword
• PARTITION keyword with more than one logical partition in the access list
• IOCLUSTER keyword
• PATH keyword with more than one CSS ID (for example, a spanned channel path)

Use of a shared channel path allows the possibility of two partitions having access to the same I/O control units and devices. This is in contradiction to the policy of strict separation. Additionally, the use of shared channels may facilitate some form of covert signaling. However, if covert signaling is not perceived to be a significant threat, it is highly recommended that each use of a shared channel be carefully analyzed for its possible effect on the installations security policy. Although a shared channel path is defined to be shared, none of the devices that are connected to it need to be shared among logical partitions. When devices are assigned to a single logical partition, they cannot be accessed by any other logical partition.

Low-speed devices (such as SCP Operator's Consoles) are especially inviting targets for sharing a single channel path using multiple image facility (MIF).

If you choose to share channel paths between Isolated logical partitions, and their access to specific devices attached to that channel path must be restricted, I/O Device Candidate Lists are the means for restricting access to devices. The default, if no I/O Device Candidate List is specified, is that all partitions sharing the MIF channel path, also share access to all attached devices. Such free access is incompatible with the concept of a secure platform that provides disjoint, non-communicating logical partitions, and is therefore not recommended. We recommend that when sharing is specified for a CHPID, all the associated, attached I/O devices (IODEVICE statement) must have a candidate list specified. Following a rule of always specifying a device's partition explicitly prevents unexpected results from defaults being applied. For further details on I/O device candidate list, refer to the discussion of the IODEVICE statement's PARTITION parameter in the Input/Output Configuration Program User's Guide for ICP.

Sharing of channel paths is controlled by the SHARED parameter, and the partition names specified in the PARTITION and NOTPART parameters for each channel path definition (CHPID statement) in the IOCDS. If the PARTITION parameter specifies multiple partition names, it specifies that this particular CHPID is shared among the named partitions. If a NOTPART parameter is used, it implies the sharing characteristic. However, if a NOTPART parameter includes all partition names but one, in both access and candidate lists, no sharing is permitted. Devices attached to a shared CHPID are restricted to the partitions included in the device candidate list (specified in the IODEVICE PARTITION parameter). If the IOCDS does not specify sharing, then no sharing of CHPIDs will take place.