ABCs of z/OS System Programming Volume 3 - IBM Redbooks

Because APF authorization is established at the job step task level, access method services
is not authorized if invoked by an unauthorized application or terminal monitor program.
RACF authorization checking
RACF provides a software access control measure you can use in addition to or instead of
passwords. RACF protection and password protection can coexist for the same data set.
To open a catalog as a data set, you must have ALTER authority and APF authorization.
When defining an SMS-managed data set, the system only checks to make sure the user has
authority to the data set name and SMS classes and groups. The system selects the
appropriate catalog, without checking the user's authority to the catalog. You can define a
data set if you have ALTER or OPERATIONS authority to the applicable data set profile.
Deleting any type of RACF-protected entry from a RACF-protected catalog requires ALTER
authorization to the catalog or to the data set profile protecting the entry being deleted. If a
non-VSAM data set is SMS-managed, RACF does not check for DASDVOL authority. If a
non-VSAM, non-SMS-managed data set is being scratched, DASDVOL authority is also
checked.
For ALTER RENAME, the user is required to have the following two types of authority:
► ALTER authority to either the data set or the catalog
► ALTER authority to the new name (generic profile) or CREATE authority to the group
Be sure that RACF profiles are correct after you use REPRO MERGECAT or CNVTCAT on a
catalog that uses RACF profiles. If the target and source catalogs are on the same volume,
the RACF profiles remain unchanged.
Tape data sets defined in an integrated catalog facility catalog can be protected by:
► Controlling access to the tape volumes
► Controlling access to the individual data sets on the tape volumes
Profiles
To control the ability to perform functions associated with storage management, define
profiles in the FACILITY class whose profile names begin with STGADMIN (storage
administration). For a complete list of STGADMIN profiles, see z/OS DFSMSdfp Storage
Administration Reference, SC26-7402. Examples of profiles include:
STGADMIN.IDC.DIAGNOSE.CATALOG
STGADMIN.IDC.DIAGNOSE.VVDS
STGADMIN.IDC.EXAMINE.DATASET
360 ABCs of z/OS System Programming Volume 3