Download PDF - IBM Redbooks

We used the RACF security server to control access to the data sets just as RACF controls
access to the DB2 subsystem. For this task, we defined RACF profiles for data sets and
permitted access to the data sets for certain DB2 IDs.
To protection DB2 data sets:
1. Add groups to control DB2 data sets:
Define special RACF groups for protection of DB2 user databases with HLQ “DB0TD,”
which must have access to DB2 data sets as illustrated in Example 8-32.
Example 8-32 Defining RACF groups
ADDGROUP DB0TD SUPGROUP(DB2GRP) OWNER(MAXIM)
2. Create generic RACF profiles for DB2 data sets by using the high-level qualifier “DB0TD,”
as shown in Example 8-33.
Example 8-33 Creating generic RACF profiles for specific DB2 data sets
ADDSD 'DB0TD.DSNDBD.**' UACC(NONE)
PERMIT 'DB0TD.DSNDBD.**' ID(SYSDSP) ACCESS(ALTER)
3. Authorize DB2 IDs to use dataset profiles.
SYSDSP is the RACF user ID for DB2 started tasks and must have full access to DB2
data sets. Security administrators can define RACF profiles for various DB2 data sets,
such as active logs, archive logs, user databases, and installation libraries.
Tip: If you use generic profiles, specify NO for ARCHIVE LOG RACF on the DSNTIPP
installation panel, or you might receive a z/OS error message when DB2 tries to create
the archive log data set. If you specify YES, DB2 asks RACF to create a separate profile
for each archive log that is created, which means that you cannot use generic profiles
for these data sets.
Example 8-34 shows the command to give authority to DB2 IDs for creating new RACF
database profiles.
Example 8-34 Authority to create RACF database profiles
CONNECT (SYSADM) GROUP(DB0TD) AUTHORITY(CREATE) UACC(NONE)
4. Enable DB2 IDs to create data sets.
Example 8-35 shows how to give the IDs (SYSADM and SYSOPR) complete control over
DB0TD DB2 data sets.
Example 8-35 Giving complete control of DB2 DB0TD data sets
PERMIT 'DB0TD.DSNDBD.**' ID(SYSADM SYSOPR) ACCESS(ALTER)
Chapter 8. Security enhancements of DB2 10 for SAP solutions 139