Using the ACF Command (DIAGLIM Setting)

Using the ACF Command (DIAGLIM Setting)

Diagnose limiting rules validate a user's authority to issue a diagnose instruction with a particular diagnose code. This validation occurs after normal CP user class validation for diagnose instructions.

Diagnose limiting rules are stored on the Infostorage database in a storage class known as the limiting class. This class, identified by L, includes both diagnose limiting and command limiting rules. Rules for diagnose limiting have a type code of VRD in the L storage class.

Loggings and violations that occur during the execution of diagnose instructions are recorded in SMF records. You can analyze these records through the Command Limiting Journal (ACFRPTCL). For more information, see the chapter “Running the Command Limiting Report (CL)” in the Reports and Utilities Guide.

SECURITY, NON-CNCL, and READALL attributes do not grant any special privilege for diagnose limiting. These attributes bypass access validation only for data access rules and resource rules.

To implement diagnose instruction validation:

• Create the diagnose limiting rule sets. All diagnose limiting rule set processing is done under the DIAGLIM setting of the ACF command. You do not need to specify the type code for diagnose limiting rules when you establish the DIAGLIM setting. For the complete syntax for a diagnose limiting rule set, see Syntax of a Rule Set in the chapter “Rule Writing Guidelines.”
• Specify the diagnose codes to include or exclude from validation through the DIAGLIM VMO record.
• Establish the mode for diagnose limiting validation. This mode is independent of the CA ACF2 for z/ VM system mode and is specified through the DIAGLIM VMO record.
• Write diagnose limiting rules for each diagnose code that you want to control in #2 above.

Remember, you must define all diagnose codes that are or are not subject to diagnose limiting rule set validation. For each diagnose instruction specified in this operand, you must write a single diagnose limiting rule set.

The rest of this chapter provides information on creating and maintaining the diagnose limiting rule sets. For more information about establishing the diagnose code and mode, see the chapter “Defining Structured Infostorage Records” in the Administrator Guide.

This section contains the following topics:

Internal Diagnose Codes

POSIX Diagnose Calls

Sample Diagnose Limiting Rule Set

Creating a Rule Set

ACF Subcommands

COMPILE Subcommand

DECOMPILE Subcommand

DELETE Subcommand

STORE Subcommand

TEST Subcommand