Maintaining Access Rules with the ACF Command › Access Rule Components › Access Rule Entries › DASD Dump Restore and FORMAT Access Rules

DASD Dump Restore and FORMAT Access Rules

You can write access rules to control the use of the DASD Dump Restore (DDR) and FORMAT service programs for protecting minidisks. This control is achieved through a unique CA ACF2 for VM validation process.

To understand this validation process, observe the following rule set. The order of the rule entries is how they are arranged when the rule set is compiled, sorted, and then decompiled. It is the order that the entries are searched when access to PAYROLL is attempted. Look at the following example:

$KEY(PAYROLL)
 V0191.‑ UID(ABCTLCNLT) R(A) W(A)
 V0191.‑ UID(ABCTLC) PGM(DDR)
 V0191.‑ UID(ABCTLC) PGM(FORMAT)
 V0191.‑ UID(ABCTLC) R(A) W(A)

The first rule entry lets user ABCTLCNLT read and write to the Payroll Department's 0191 minidisk. This access inherently lets ABCTLCNLT use the DDR and FORMAT programs on that minidisk.

You can write additional, more specific rule entries to prevent a user who has read or write access to a minidisk from using DDR and FORMAT. This is illustrated with the rest of the entries in the rule set.

The last rule entry lets all users in the Payroll Department (other than ABCTLCNLT) have read and write access to the same 0191 minidisk. These users are prevented from using the DDR and FORMAT programs because of the second and third rule entries.

• The second rule entry prevents users from having DDR access on the minidisk. More specifically, they are prevented from using the DDR DUMP function to move data from DASD onto tape. They are also prevented from using the DDR RESTORE function to return data onto DASD.

  To use DDR DUMP if a PGM(DDR) rule entry is in effect, a user must be granted PGM(DDR) read access through the R(A) or R(L) access permissions. To use DDR RESTORE if a PGM(DDR) rule entry is in effect, a user must be granted PGM(DDR) write access through the W(A) or W(L) access permissions. Additionally, another rule entry must allow the use of the FORMAT program.

• The third rule entry prevents users from having FORMAT access on the minidisk. More specifically, they are prevented from using the DDR RESTORE function to return data onto DASD. They are also restricted from using the FORMAT program to prepare DASD for use (eliminating all previous data).

  To use DDR RESTORE if a PGM(FORMAT) rule entry is in effect, a user must be granted PGM(DDR) write access in a previous rule entry (such as the second entry in the example) through the W(A) or W(L) access permissions and PGM(FORMAT) write access through the W(A) or W(L) access permissions.

  When DDR RESTORE is executed, the PGM(FORMAT) validation is not performed when the previous validation- performed through PGM(DDR)-denies the access. Also, if the previous PGM(DDR) validation logs but allows the access, two loggings are created instead of one if the PGM(FORMAT) validation also causes a logging.

  To use FORMAT if a PGM(FORMAT) rule entry is in effect, a user must be granted PGM(FORMAT) write access through the W(A) or W(L) access permissions.

After the rule set is compiled and sorted, the DDR and FORMAT rule entries must appear before any rule entries that let the user access the minidisk. The previous example illustrates this clearly.