Securing resources

You or your RACF® administrator can secure your JES2 resources by creating RACF resource profiles. Each profile (or generic profile) contains:

The name that identifies a resource or group of resources
The class of the resource
The availability of the resource to all users
A list of user IDs or group IDs that can access the resource and their authorization level, if needed
An optional security label for the resource
Other security-related information.

The profile name identifies a resource or set of resources to RACF. The name that identifies a resource to JES2 (defined in the initialization data set) is the basis of the profile name your RACF administrator uses to define the RACF profile.

Your security administrator defines different types of resources (printers, nodes, and SYSOUT, for example) to different RACF classes. Table 1 shows the JES2 resource type and the classes that your RACF administrator can use to define the resource.

Table 1. JES2 resources and associated RACF classes
JES2 resource	RACF profile name format	RACF classes	Class purpose
Commands from Network Job Entry (NJE) Nodes	NJE.nodename jesname.command[.qualifier] node.RUSER.userid	FACILITY OPERCMDS NODES	Allows a node to issue commands to your system
Commands from RJE Workstations	jesname.command[.qualifier]	OPERCMDS and FACILITY	Restrict commands to authorized users
Data sets JES2 uses Initialization data set Spool data sets Checkpoint data sets Procedure libraries Module libraries Parameter libraries Spool offload data sets	'data set name'	DATASET (always active)	Prevents unauthorized access to data sets
Data Sets Residing on Spool SYSIN SYSOUT JESNEWS Trace data sets SYSLOG	localnodeid.userid.jobname.jobid.dsidentifier.name localnodeid.userid.jobname.jobid.dsidentifier.name localnodeid.jesid.$JESNEWS.STCtaskid.Dnewslvl.JESNEWS localnodeid.jesname.$TRCLOG.taskid.dsidentifier.JESTRACE localnodeid.+MASTER+.SYSLOG.jobid.dsidentifier.?	JESSPOOL	Restrict access to data on spool to authorized users
Input Sources Readers Internal Readers (INTRDR) STCINRDR TSUINRDR Remote Job Entry (RJE) Workstations Network Job Entry (NJE) Nodes¹ Spool Offload Receivers Note: TSUINRDR and TSOINRDR are used interchangeably.	RDRnn as defined on the RDR(nn) initialization statement INTRDR STCINRDR TSUINRDR OFFn.SR and OFFn.JR as defined in the initialization stream Note: TSUINRDR and TSOINRDR are used interchangeably.	JESINPUT (see note)	Restricts users submitting specific jobs to specific devices
Job Group registration of a job to a job group	GROUPREG.node.groupname.userid	JESJOBS owned by the specified userID	Controls which users can register a job with the specified group
Job modification and cancellation	HOLD.nodename.userid.jobname RELEASE.nodename.userid.jobname PURGE.nodename.userid.jobname CANCEL.nodename.userid.jobname START.nodename.userid.jobname RESTART.nodename.userid.jobname SPIN.nodename.userid.jobname MODIFY.nodename.userid.jobname REROUTE.nodename.userid.jobname	JESJOBS (see note)	Controls which jobnames and user IDs users can use when modifying or cancelling jobs.
Local Commands	jesname.command[.qualifier]	OPERCMDS	Restricts commands to authorized users
Network Job Entry (NJE) Nodes	nodeid.keyword.entity*. NJE.ownnode.othernode SESSKEY(key)	NODES APPCLU	Prevents processing of unauthorized jobs or sysout from another node Extracts the encryption key to control NJE signons
Output Devices Local and FSS devices RJE devices NJE devices Spool Offload Transmitters	jesname.LOCAL.devicename jesname.RJE.devicename jesname.NJE.nodename	WRITER	Restricts processing of output to specific devices
Remote Job Entry (RJE) Workstations	RJE.workstation-id	FACILITY	Prevents unauthorized signon by remotes
Update JESNEWS	jesname.UPDATE.JESNEWS	OPERCMDS	Restricts ability to create, update, and delete JESNEWS.
Note: At least one profile that defines all jobs must exist in this class when this class is active or all jobs fail. ¹ See Authorizing networking jobs and SYSOUT (NJE).

When RACF is active, every user must have a RACF user profile, any class in use must be active, and all resources you want to protect must have a resource profile (except those in the JESSPOOL class). Before JES2 completes a request for a resource from a user, JES2 requests authorization from SAF. SAF passes the request to RACF which determines the authority based on the existing profiles. If RACF is not active or cannot determine the authorization for a resource, JES2 carries out its own security processing, if any, for that resource. The z/OS Security Server RACF Security Administrator's Guide has additional information about profiles and access.