How to block a CL command that uses QIBM_QCA_CHG_COMMAND exit point

Steps

The exit program registration facility provides two exit points for control language (CL) commands on the system.

QIBM_QCA_CHG_COMMAND exit point and QIBM_QCA_RTV_COMMAND.

QIBM_QCA_CHG_COMMAND can change the original called CL command. You can change the parameters of the command, or run another CL command instead, or exit the running of this command. It is called before the command processing program.

QIBM_QCA_RTV_COMMAND is good for checking that command and the parameters of the called CL command, before or after the command processing program is called, according to the value when the Exit Point was registered for this QIBM_QCA_RTV_COMMAND exit point.

You can use RTVJOBA command in the Exit Point of QIBM_QCA_CHG_COMMAND, and do what you want, such as block a specific user from running this command. The blocking of the command is done in the Exit Point program by sending an *ESCAPE error message.

There is no option in the Exit Point to allow or disallow the command.

Here is an example to block the command. You need to add logic to check the user ID name part.
The command is rejected by sending an *ESCAPE message with the QMHSNDPM API.

The remaining document covers how to block CRTLIB command for user profile Tosh.
A sample CL source for the Exit Point program is:
 

             PGM        PARM( &CMDINFO &RPLCMD &LENRPLCMD)
             DCL        &CMDINFO   *CHAR 32000
             DCL        &EXITNAME *CHAR 20 STG(*DEFINED) DEFVAR(&CMDINFO  1 )
             DCL        &EXITFMT  *CHAR  8 STG(*DEFINED) DEFVAR(&CMDINFO 21 )
             DCL        &CMDNAM   *CHAR 10 STG(*DEFINED) DEFVAR(&CMDINFO 29 )
             DCL        &CMDLIB   *CHAR 10 STG(*DEFINED) DEFVAR(&CMDINFO 39 )
             DCL        &CHANGE   *CHAR  1 STG(*DEFINED) DEFVAR(&CMDINFO 49 )
             DCL        &PROMPT   *CHAR  1 STG(*DEFINED) DEFVAR(&CMDINFO 50 )
             DCL        &OFSCMD   *INT   4 STG(*DEFINED) DEFVAR(&CMDINFO 53 )
             DCL        &LENCMD   *INT   4 STG(*DEFINED) DEFVAR(&CMDINFO 57 )
             DCL        &OFSPRX   *INT   4 STG(*DEFINED) DEFVAR(&CMDINFO 61 )
             DCL        &CNTPRX   *INT   4 STG(*DEFINED) DEFVAR(&CMDINFO 65 )
             DCL        &RPLCMD    *CHAR 32000
             DCL        &LENRPLCMD *INT 4
             DCL        &POS       *INT 4
             DCL        &LEN       *INT 4
             DCL        &MSGTXT    *CHAR 1024
             DCL        &User     *CHAR 10
             DCL        &JOBTYPE) *CHAR 1
             DCL        &MSGKEY   *CHAR 4
             DCL        &ERRCODE  *CHAR 16 VALUE(x'0000000000000000+
                                                   0000000000000000')

/* You can use RTVJOBA  USER(&User) command in the EP of QIBM_QCA_CHG_COMMAND,       */
/* and do what you want, such as block a specific user from running this command.    */
             RTVJOBA    USER(&USER) TYPE(&JOBTYPE)
             IF         COND(&USER *EQ 'TOSH') THEN(DO)
                CHGVAR VAR(&RPLCMD VALUE(' ')
                CHGVAR VAR(&LENRPLCMD) VALUE(0)
                CALL PGM(QMHSNDPM) PARM('CPF9898' 'QCPFMSG   *LIBL' +
                'Command not allowed for user: ' *BCAT &USER +
                x'0000002F' '*ESCAPE' '*PGMBDY' x'00000002' +
                &MSGKEY &ERRCODE
             ENDDO
             ENDPGM   

The above CL was compiled as program BLKCRTLIB.

To block CRTLIB command for user Tosh, add this Exit Point

ADDEXITPGM EXITPNT(QIBM_QCA_CHG_COMMAND) FORMAT(CHGC0100) PGMNBR(*HIGH)
PGM(YOURLIB/BLKCRTLIB) PGMDTA(*JOB *CALC 'CRTLIB    QSYS      ')

From an interactive session for user TOSH, if an attempt is made to use command CRTLIB then it will be blocked.

crtlib lib(mytest)                                                    
  2300 - RTVJOBA USER(&USER) TYPE(&JOBTYPE)                              
Command not allowed for user: TOSH                                          

Here user TOSH runs a batch job to use command CRTLIB.
 

SBMJOB CMD(CRTLIB LIB(MYTEST)) LOG(4 00 *SECLVL) LOGCLPGM(*YES)

CPF9898 Command not allowed for user: TOSH

The outcome is still the same, CRTLIB will be 'blocked'.