Be aware that NOPASS and NODSI are no longer honored for batch jobs

Description

In the SCHEDxx parmlib member, the PPT statement allows your installation to specify a list of programs that require special attributes, or to change the attributes of the IBM-supplied default entries in the Program Properties Table (PPT). Before the system initiates a program, it scans the PPT to determine which, if any, special attributes to apply to the program.

In z/OS V2R1 and later releases with APAR OA50215, the NOPASS and NODSI PPT attributes are ignored by the system for programs that run as batch job steps (non-started tasks).

Briefly, these attributes are described, as follows:
NOPASS
The specified program can bypass security protection (password protection and RACF®).
NODSI
The specified program does not require data set integrity. That is, the job does not hold an ENQ for the data sets it allocates.

For installations that require these options for batch jobs, APAR OA50215 introduces the new PPT attributes NOPASS_ALLOWBATCH and NODSI_ALLOWBATCH, which you can specify in SCHEDxx. However, the new attributes are not recommended and must be used with care.

Table 1 provides more details about the migration action. Use this information to plan your changes to the system.

Table 1. Information about this migration action
Element or feature: BCP
When change was introduced: z/OS V2R3. z/OSV2R2 and z/OS V2R1, both with APAR OA50215 applied.
Applies to migration from: z/OS V2R2 and z/OS V2R1, both without APAR OA50215 applied.
Timing: Before installing z/OS V2R3.
Is the migration action required? Yes, if your installation specifies the PPT attributes NOPASS or NODSI for programs that run as batch job steps.
Target system hardware requirements: None.
Target system software requirements: None.
Other system (coexistence or fallback) requirements: None.
Restrictions: None.
System impacts: If your installation specifies the PPT attributes NOPASS or NODSI for programs that run as batch job steps, these specifications are no longer honored. Instead, the following message is issued: 
IEF188I PROBLEM PROGRAM ATTRIBUTES ASSIGNED
Related IBM Health Checker for z/OS check: None.

Steps to take

Follow these steps:
  1. Check your active SCHEDxx parmlib members for usage of the NOPASS or NODSI attributes. You can display the contents of your active SCHEDxx parmlib members by using the command DISPLAY PPT.
  2. For any program for which NOPASS or NODSI is specified, determine whether the program runs as a batch job step. For such programs, consider removing the NOPASS or NODSI attributes.

    Otherwise, if these attributes are required for the program, replace them with the NOPASS_ALLOWBATCH and NODSI_ALLOWBATCH attributes. Be aware that allowing programs that run as batch job steps to receive the NOPASS_ALLOWBATCH or NODSI_ALLOWBATCH attributes can expose potential integrity issues.

    Tip: To determine whether the new attributes are in effect, enter the command DISPLAY PPT. In the command output, check for Y in column DA (NODSI_ALLOWBATCH) and Y in column PA (NOPASS_ALLOWBATCH).

Reference information

For more information about the SCHEDxx parmlib member, see z/OS MVS Initialization and Tuning Reference.