Writing Tape Volume Access Rules

Maintaining Access Rules with the ACF Command › Access Rule Components › Access Rule Entries › Writing Tape Volume Access Rules

Writing Tape Volume Access Rules

CA ACF2 for VM validates volumes that are defined in the TAPEVOLS field list through tape volume access rules. The rule set syntax for tape volume access is similar to that of any other access rule set:


  [ volser|VOLUME   ]
  [ UID(uid)        ]
  [ SOURCE(source)  ]
  [ SHIFT(shift)    ]
  [ UNTIL(date)     ]
  [ FOR(days)       ]
  [ READ(A|L|P)     ]
  [ WRITE(A|L|P)    ]
  [ DATA(data)      ]
  [ NEXTKEY(ruleid) ]

The access types, for example, are syntactically identical and have the same meanings:

READ(A) specifies that read access to a tape is allowed.
WRITE(A) specifies that write access to a tape is allowed.

The volser value is specified as:

@volser.VOLUME: The $KEY value is the tape volume label (volser) with the prefix @. The pseudo data set name (or filename) is VOLUME. A separate rule set is required for each tape volume secured in the TAPEVOLS list. For example, with the previous TAPEVOLS list, the following rule sets apply:
```
$KEY(@767305)
 VOLUME UID(*****TLC) WRITE(A)
 
$KEY(@123AAA)
 VOLUME UID(*****TLC) WRITE(A)
```
VOLUME.@volser: The $KEY value is VOLUME. The pseudo data set name (or filename) is the tape volume label (volser) with the prefix @. Only one rule set is required for all tape volumes secured in the TAPEVOLS list. For example, with the previous TAPEVOLS list, the following rule set applies:
```
$KEY(VOLUME)
 @767305 UID(*****TLC) WRITE(A)
 @123AAA UID(*****TLC) WRITE(A)
```

Use the NOVOLRULE|VOLRULE operand of the RULEOPTS VMO record to determine how to specify the volser in tape volume access rules. If you specify VOLRULE, you must specify the volser of a tape volume in the @volser.VOLUME format. If you specify NOVOLRULE (the default), you must specify the volser of a tape volume in the VOLUME.@volser format.

Issue the SHOW STATE subcommand to display the current VOLRULE setting. For more information on the VOLRULE field of the RULEOPTS VMO record, see the “Defining Structured Infostorage Records” chapter.

To access a tape volume, you must enter the ACFMOUNT command specifying the volser of the tape. If you enter the command syntax correctly and the volser is defined in the TAPEVOLS VMO record, a tape volume access rule is validated to see if the user is allowed to read from or write to the volume. If access is allowed, CA ACF2 for VM prompts the system operator to mount the indicated volume. (You can enforce additional validation through command limiting of ACFMOUNT.)

Another aspect of CA ACF2 for VM protection for tape volumes concerns tape volume reuse protection, implemented through the ACFERASE utility that erases all of a tape's data. The system operator responsible for the protection of tape volumes is typically given authority to use this utility, although an exec or program normally calls ACFERASE.