Authorization

Users authorized to perform special functions are defined as having appropriate privileges, and are called superusers. Users with appropriate privileges are also those with:

A user ID of zero
RACF-supported user privileges trusted and privileged, regardless of their user ID

The ability to change the MVS™ identity of an address space is reserved for a subset of superusers who control daemons. A daemon is a process that verifies the identity of a user before creating a process to run work on behalf of the user. This approach allows the installation to have superusers whose job is to maintain the file system and user processes, but who do not have the ability to change their user identity. See Setting up the BPX.* FACILITY class profiles in z/OS UNIX System Services Planning for a description of the BPX.DAEMON resource profile in the RACF® FACILITY class and how it is created. This information also describes additional BPX.xxxxxxxx resource profiles in the FACILITY class that are used to provide selective permission to certain restricted functions.

Also, superusers are said to have daemon authority if the BPX.DAEMON resource profile is defined and they have access to it. If BPX.DAEMON is not defined, the users have daemon authority if they are a superuser.

Note that aliases can be supplied for user IDs. Callable services that pass or receive user ID parameters may need to use the userid alias table. Its use is described in USERIDALIASTABLE in z/OS UNIX System Services Planning.

Note: This information assumes that your operating system contains Resource Access Control Facility (RACF). You could use an equivalent security product updated to handle z/OS UNIX security.