Rule Writing Guidelines › How Commands Are Validated

How Commands Are Validated

To write effective command limiting rules, you must understand how rule entries are sorted and interpreted. You must also understand the matching environment concept. These concepts and the command validation process are explained in the following sections.

Rule Entry Sorting

Rule entries are automatically sorted from most specific to most general. CA ACF2 for z/ VM sorts command limiting rule sets as follows:

Operands

Alphabetically, masked then unmasked

UID

UID of the users the rule applies to

SHIFT operands

In alphabetical order, with ”none specified” last

SOURCE operands

In alphabetical order, with ”none specified” last

UNTIL|FOR

Last Gregorian date the rule is valid on.

Rule entries are sorted this way to make rule interpretation more efficient and rule writing simpler. To interpret a sorted rule, CA ACF2 for z/ VM simply compares the first rule entry to the actual user request, then the second, third, and so on.

The $NOSORT control statement stores and interprets rule entries in the exact order they are entered in the rule set. We do not recommend using $NOSORT. If you must use it, be sure to test the unsorted rule carefully to ensure it works as expected.

Matching Environment Concept

A rule match occurs when the operand values defined in a rule entry correspond to the actual environment of the user’s command request. The first rule entry that matches determines if the command is allowed to execute, allowed but logged, or prevented and logged.

To summarize, CA ACF2 for z/ VM validates access to a CP command and operand combination by:

• Searching for a command model that matches the syntax and format of the command the user issued. This command is then converted into the format CA ACF2 for z/ VM requires and the operands are sorted as defined in the command model. If no command model is found for a particular command, the MODE field of the CMDLIM VMO record defines how the command request is handled.
• Checking each entry in the rule set for a match of the UID, SHIFT, SOURCE, and UNTIL dates. If CA ACF2 for z/ VM finds no matching entry, the MODE field of the CMDLIM VMO record defines how the command request is handled.

  When CA ACF2 for z/ VM finds a matching rule entry, it checks the entry to determine if the command format in the rule entry matches the command entered by the user. If the formats match, the user’s command is compared to the rule entry.

• Interpreting the first rule entry that matches the user’s access environment (command format, UID, SHIFT, SOURCE, UNTIL, and operands). The command then executes, executes but is logged, or is denied and logged, based on the access permission values in the matching rule entry. If CA ACF2 for z/ VM finds no matching rule entry, the MODE field of the CMDLIM VMO record defines how the command request is handled.
• If the command affects a spool file, checking the system spool to ensure the user is authorized to manipulate all of the files in the scope of the command. For more information, see Command Limiting the CP Spooling System.