z/OS Network File System Guide and Reference
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Ownership and permissions

z/OS Network File System Guide and Reference
SC23-6883-00

The UNIX UID and GID file attributes are reset to their default state (UID=0 and GID=0) after a restart of the z/OS NFS server or an unmount of the file system. In some cases, this requires that a superuser on the client workstation reissue chown and chgrp commands to reset the UID and GID. These commands can be included in the same script used to mount the file system.

The permissions checking done by RACF®, a component of the Security Server for z/OS, or an equivalent security package, is transparent to you. Access to a data set is granted, provided that the server's exports list, the MVS security subsystem, and the customized installation security exit allow access to the data set. Which of these security systems are active depends on the security settings used at your installation. The UNIX file modes or permission bits are ignored by z/OS NFS server and authorization is done with the RACF or equivalent security package.

UNIX's UID, GID, and MODE attributes are not used by the z/OS NFS server for checking user access to z/OS conventional MVS data sets (see previous paragraph). UNIX's chown, chgrp, and chmod commands do not update z/OS RACF security policies and will not alter access to files. Do not use returned values to determine access rights. The z/OS NFS server supports the setting and obtaining of these attributes to minimize impact to client applications. For performance, validation of passed values is limited to the following checks for proper operations.

When a new MVS data set is created, the UID and GID are inherited from the NFS RPC, or from z/OS UNIX segment, or from the RPC Authentication, in the listed priority order.

CHOWN
Request is failed with EPERM if changing to a value other than yourself. Change to yourself is allowed for mount support.
CHGRP
No checking.
CHMOD
No checking, new value ignored, existing z/OS NFS server value is left unchanged, “success” is returned to the client.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014