Conversion Utilities › ACFCVSFS - Converting SFS Grants to CA ACF2 for z/VM Rules

ACFCVSFS - Converting SFS Grants to CA ACF2 for z/VM Rules

This utility creates access rules from existing Shared File System (SFS) grants for a filepool.

Prerequisites

You cannot run ACFCVSFS when the external security for SFS is set to ON. If it is on, the exec stops during execution.

You must run ACFCVSFS from a virtual machine that is an SFS administrator for the target filepool. This virtual machine must have sufficient CA ACF2 for z/VM authority to decompile all rules for every file owner in the target filepool.

You should only run ACFCVSFS on one virtual machine at a time because it fetches existing rules from the database for modification. If you run ACFCVSFS on more than one virtual machine at a time, you could lose rules created by one of the virtual machines.

Running ACFCVSFS

Enter the following command to run this utility:

ACFCVSFS fpool fm (APPEND

fpool

The name of the filepool CA ACF2 for z/VM uses to create the rule files.

fm

The output filepool for the newly created CA ACF2 for z/VM rule files. All output files have a filename that is the same as the owner's name and a filetype of RULE. The output files replace existing files of the same filename and filetype unless you specify APPEND.

APPEND

An operand that specifies that CA ACF2 for z/VM should append new rules to existing rules with the same filename and filetype. By default, CA ACF2 for z/VM replaces existing rule files with the same filename and filetype.

This utility can require large amounts of virtual storage to complete processing. The amount of storage depends on:

• The largest number of files in any single directory in the target filepool, and
• The largest number of users granted access to any single directory in the filepool, and
• A combination of these two factors.

If you run out of virtual storage, increase the virtual storage size until ACFCVSFS completes successfully.

Output

Shown below is a sample of the displays you see as this utility runs:

acfcvsfs tlc b (append
Scanning SFS directory TLC:PAYROLL
Scanning SFS directory TLC:PAYROLL.CHICAGO
Scanning SFS directory TLC:PAYROLL.NEWYORK
Scanning SFS directory TLC:PAYROLL.TAMPA
”PAYROLL RULE B” has been modified.
Scanning SFS directory TLC:OVERTIME
Scanning SFS directory TLC:OVERTIME.CHICAGO
Scanning SFS directory TLC:OVERTIME.CHICAGO.HOLIDAY
Scanning SFS directory TLC:OVERTIME.NEWYORK
Scanning SFS directory TLC:OVERTIME.NEWYORK.HOLIDAY
Scanning SFS directory TLC:OVERTIME.TAMPA
Scanning SFS directory TLC:OVERTIME.TAMPA.HOLIDAY
”OVERTIME RULE” has been modified.
Scanning SFS directory TLC:SALARY
Scanning SFS directory TLC:SALARY.CHICAGO
Scanning SFS directory TLC:SALARY.NEWYORK
Scanning SFS directory TLC:SALARY.TAMPA
”SALARY RULE B” has been modified.
ACFCVSFS processing complete.
Ready; T=37.78/42.35 15:56:33

ACFCVSFS can produce RULE files that are too large to compile using the ACF command. If this happens, you need to manually split the large rules using NEXTKEY or additional masking. This utility takes advantage of masking to reduce rule size whenever a user has the SFS NEWREAD or NEWWRITE authority for a directory. Before running this utility, you should review granting the NEWREAD and NEWWRITE authorities.