How Does CA ACF2 for z/VM Work? › Controlling Access to Resources › What are Resource Rule Sets?

What are Resource Rule Sets?

Resource rule sets are groups of related resource rules that control access to system resources. Resource rule sets are very similar to access rule sets. A resource rule set can contain all of the following:

• Control statements
• Resource rule entries
• Access permissions.

Control Statements

Control statements are parameters that begin a rule set. They specify conditions that apply to the whole rule set or to the rule entries. You can use two types of control statements in a rule set, those that begin with a $ (dollar sign) and those that begin with a % (percent sign). The only required control statements in resource rules are the $KEY and the $TYPE. The $KEY control statement is the name of the resource you want to protect. The $TYPE is the three‑character type code of the resource. CA ACF2 for z/VM provides six type codes that you can modify:

ACT

Controls account use

ALG

Controls the target of the AUTOLOG command

GRP

Controls access to group IDs

DIA

Controls the target of the DIAL command

IUC

Controls access to the Inter‑User Communications Vehicle (IUCV)

VMC

Controls access to the Virtual Machine Communications Facility (VMCF).

These are the default resource types. You can also define your own resource type codes. The control statements of the rule set determine such attributes as:

• The resource name and type of the record
• User information to supply to locally‑defined exits
• The users who have the authority to change the entire rule set.

Resource Rule Entries

Resource rule entries are statements that specify the conditions for resource access. In a rule entry, you can specify any of the following keywords to control the access:

DATA

Specifies an optional keyword for any comments you want to enter about the rule entry. Comments can be up to 64 characters long. DATA does not affect CA ACF2 for z/VM validation.

SHIFT

Specifies an optional keyword that specifies the name of a shift record that resides on the Infostorage database. The specified shift record defines the dates and time‑of‑day that this user can access the system. If you do not specify this keyword, the rule entry applies to all shifts.

SOURCE

Specifies an optional keyword that defines an input source. To use the resource, the user request must come from the source ID specified in the rule entry. If you do not specify this keyword, the rule entry applies to all sources.

UID

Specifies the user identification string of the user that the rule entry applies to. You can mask the UID.

UNTIL|FOR

Specify optional keywords. UNTIL specifies the date that the rule expires and becomes invalid. FOR specifies the number of days that the rule entry is valid. FOR is automatically translated into an UNTIL date when you compile and store the rule entry. For example, if you compile and store a rule entry on October 1, 1999 with FOR (10) specified, the rule entry automatically expires on October 10, 1999. If you do not specify UNTIL or FOR, the rule entry applies to all dates

Access Permissions

The next four keywords (ALLOW, LOG, PREVENT, and SERVICE) are related. They specify whether access to the resource is allowed if the rule environment matches a user‑access environment.

These keywords determine how CA ACF2 for z/VM validates the user’s request. Keyword meanings are:

ALLOW

The access is allowed.

LOG

The access is allowed, but logged.

PREVENT

The access request is prevented and logged. This is the default.

SERVICE (READ|ADD|UPDATE|DELETE)

SERVICE extends the level of control that a rule entry specifies. The SERVICE level is application‑specific and controls access to the data.