PK18624: RAS SECURITY ERRORS. IXXX AND LXXX RESOURCE CLASSES ARE NOT RACLISTED IF DFS2466I FOR PXXX, SXXX, FXXX AND OXXX.

APAR status

• Closed as program error.

Error description

• - RCLASS on security macro = xxx (other than 'IMS' default)
  - I/J/L/Mxxx classes added to RACF and activated.
  - IMS is brought up with ISIS=R (RASRACF) and unauthorized
    BMPs are allowed to run. ABENDU0437 is expected, but
    doesn't occur.
  - RACF command - SETR LIST shows:
    GLOBAL=YES RACLIST ONLY =  Txxx Cxxx
  - Ixxx and Lxxx not being RACLISTed.
  *
  In DFSIRAC0 BLDAUTH RACLISTs the OPTIONAL classes - P,S,F and O.
  These are not used at the account and not setup in RACF. This
  causes MSGDFS2466I which is expected and ignored. However, in
  DFSIRAC0 we don't return after setting up the DFS2466I to
  RACLIST the 'I' and 'L' classes for RASRACF ISIS=R.
  

Local fix

• Define and initialize the database (P), segment (S), field (F)
  and other (O) classes to RACF to avoid DFS2466I. This will allow
  a good return and processing to continue with the RACLIST
  for RASRACF option.
  Additional Keywords: IIMS JIMS
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All IMS R910 users with RACF security.       *
  ****************************************************************
  * PROBLEM DESCRIPTION: RACF allows unauthorized BMPs to run    *
  *                      instead of failing with ABENDU0437.     *
  ****************************************************************
  * RECOMMENDATION: INSTALL CORRECTIVE SERVICE FOR APAR/PTF      *
  ****************************************************************
  The BLDAUTH routine in DFSIRAC0 returns from processing
  once a DFS2466I message is issued for RACLIST failure.
  Optional RCLASSes are not RACLISTed after the message
  was produced. This results in unauthorized BMPs running
  when they should fail with an ABENDU0437.
  

Problem conclusion

• AIDS: RIDS/DCS RIDS/CNTRL DCS CNTRL
    DEP: NONE
    GEN:
  
  *** END IMS KEYWORDS ***
  DFSIRAC0 - Modifiy the BLDAUTH routine to return using the
  linkage register and continue processing the optional
  RCLASSes. Save the address of the DFS2466I message for
  processing after the optional RCLASSes have been RACLISTed.
  
  KEYWORDS: BLDAUTH RCLASS RACF MSGDFS2466I
  

Temporary fix

• *********
  * HIPER *
  *********
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK17264

Modules/Macros

• DFSIRAC0
  

Fix information

• Fixed component name

  IMS V9

• Fixed component ID

  5655J3800

Applicable component levels

• R900 PSY UK17264

     UP06/08/29 P F608 Ž