When a program issues an SVC or accesses a load module through
a LINK, LOAD, or XCTL macro, the system considers the following factors
when checking authorization:
- Whether or not the calling program is authorized
- Whether the called program is a restricted SVC or a load module
in an authorized data set or the link pack area.
Table 1 describes the authorization rules:
Table 1. Authorization
Rules| Rule |
Abend Resulting From
Violation |
|---|
| An unauthorized routine cannot call a restricted
SVC. |
047 |
| A routine running in supervisor state, system
key, or APF-authorized cannot call programs residing outside APF-authorized
data set or the link pack area. |
306 |
The rules shown in
Table 1 are also true
when the ATTACH macro is used unless the RSAPF keyword is specified.
An attaching task that specifies RSAPF=YES and is running in supervisor
state or PSW key 0-7 can attach programs residing outside APF-authorized
data set or the link pack area if the following conditions are met:
- The caller is not running APF-authorized.
- The caller is attaching a subtask in problem state.
- The attached task's TCB key is 8-15 (non-system key).
The newly attached subtask does not run APF-authorized. If the
attaching task is not in supervisor state or PSW key 0-7, the default,
RSAPF=NO, is taken and a 306 abend might result.
However, if the subtask comes from an APF-authorized data set or
the link pack area and is link edited with the APF-authorized attribute,
then the task executes with APF authorization.