Setting UNIX access privileges

You can define profiles in the UNIXPRIV class to grant RACF® authorization for certain z/OS® UNIX privileges.

These privileges are automatically granted to all users with z/OS UNIX superuser authority. By defining profiles in the UNIXPRIV class, you may specifically grant certain superuser privileges with a high degree of granularity to users who do not have superuser authority. This allows you to minimize the number of assignments of superuser authority at your installation and reduces your security risk.

For details see z/OS Security Server RACF Security Administrator's Guide.

See z/OS Unix System Services Planning for a list of the resource names available in the UNIXPRIV class, the z/OS UNIX privilege associated with each resource, and the level of access required to grant the privilege.

To define the profiles so that you can use the ps -A USS shell command:
  1. If the UNIXPRIV class is not active, enter:
    SETROPTS CLASSACT(UNIXPRIV) RACLIST(UNIXPRIV)
  2. Define the RACF profile for the privileges:
    RDEFINE UNIXPRIV SUPERUSER.PROCESS.GETPSENT UACC(NONE)
  3. To grant READ access to the user OPER1:
    PERMIT SUPERUSER.PROCESS.GETPSENT CLASS(UNIXPRIV) ID(OPER1) ACC(READ)
  4. Perform an RACF refresh:
    SETROPTS RACLIST(UNIXPRIV) REFRESH