Writing Command Limiting Rules › Selecting CP Commands for CA ACF2 for z/VM Validation

Selecting CP Commands for CA ACF2 for z/VM Validation

Before writing any command limiting rules, select the CP commands to include or exclude from CA ACF2 for z/VM validation.

CP Commands You Can Exempt from Validation

You may not need to validate the execution of certain CP commands because VM Class G users may commonly use them. Such commands include:

BEGIN

Continues or resumes execution in the virtual machine at the specified location

CLOSE

Ends the spooling activity

RESET

Clears all pending interrupts from the specified virtual devic

STORE

Stores data in specific registers or locations

SYSTEM

Clears virtual storage and associated keys, or simulate the RESET or RESTART commands

TERMINAL

Sets virtual console options.

CP Commands Recommended for Validation

You may need to tightly control the execution of other CP commands. This can include Class A commands such as:

FORCE

Logs the specified user off the system

SHUTDOWN

Terminates all VM/SP functions

STCP

Changes the contents of real storage.

You can also allow the use of certain commands, but log their execution. When determining which CP commands to include or exclude from validation, you can use the previous lists of commands as a guide. You should carefully review the security exposures imposed by each CP command and place controls where necessary.