CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

There are two methods of defining a default user ID to a started task:
► Use the RACF exit - ICHRIN03
► Use the STARTED class in RACF. The following example shows the user ID
CTGUSER, in the CICS group, being assigned as the user ID for all
SCSCTG* tasks:
RDEF STARTED SCSCTG*.* STDATA(USER(CTGUSER) GROUP(CICS) PRIVILEGED(NO)
TRUSTED(NO))
More information can be found in the RACF Systems Programmer’s Guide,
SC28-1913.
Program control
To use RACF security functions within the CICS TG, all data sets, or HFS files,
the CICS TG uses must be marked as program controlled. In the UNIX System
Services context, program control allows RACF to secure UNIX System Services
executables as if they were MVS programs. If you have not turned on program
control for the required data sets, you will probably get 02AF (address bit dirty)
abends.
The UNIX System Services command extattr +p is then used to mark UNIX
System Services files as program controlled. You need to be the superuser to
modify the file permissions, so it is best to issue the extattr command as
superuser.
These commands mark the CICS TG files as program controlled:
extattr +p /usr/lpp/ctg500/ctg/bin/lib*.so
extattr +p /usr/lpp/ctg500/ctg/bin/SECURES
The following command marks Java files that the CICS TG requires to be
program controlled:
extattr +p /usr/lpp/java/IBM/J1.3/bin/*
To verify the program control commands worked, you can issue the ls -E
command from a UNIX System Services shell. Example 7-4 is an example of the
output of this command. The -p in the second column shows that program
control is set.
Example 7-4 CICS TG program controlled files
CICSRS2 @ SC66:/usr/lpp/ctg500/ctg/bin>ls -E
total 20072
-rwxr-xr-x --s- 1 CTGUSER SYS1 84990 Jun 21 00:04 CTGLOG.HLP
-rwxr-xr-x --s- 1 CTGUSER SYS1 57410 Jun 25 12:18 CTGMSG.HLP
-rwxr-xr-x --s- 1 CTGUSER SYS1 12662 Jun 21 00:04 CTGSAMP.INI
-rwxr-xr-x -ps- 1 CTGUSER SYS1 139264 Jun 21 00:04 SECURES
Chapter 7. TCP connections to the Gateway daemon on z/OS 145