NJE and RJE

You can use network job entry (NJE) and remote job entry (RJE) in a multilevel-secure system if you configure them correctly. Security labels assigned to jobs arriving via RJE are restricted by the security label assigned to the RJE reader's JESINPUT profile. The default security label for jobs read in on an RJE reader is obtained from the RMTxxxx user ID assigned to the remote device. SYSOUT sent on RJE devices is controlled using WRITER class profiles in the same way as on a local printer. Jobs and SYSOUT arriving via NJE are also restricted by the security label assigned to the adjacent node profile in the JESINPUT class. The default security label assigned to the job is determined by the security label sent by the originating node as interpreted by the NODES class profiles. WRITER class profiles also control what jobs and SYSOUT can be sent to other nodes. For NJE and RJE, a JOB or SYSOUT that has a security label that is not active on the system that receives the JOB or SYSOUT fails job validation, and the system purges the job or SYSOUT. For more information on NJE and RJE security considerations, see z/OS JES2 Initialization and Tuning Guide.

Protect NJE and RJE input resources with profiles in the JESINPUT class, assigning a security label to each of them. Protect NJE and RJE printers with profiles in the WRITER class, assigning a security label to each. JES transmits work to an NJE or RJE printer only if the printer's security label dominates the work's security label.