System Installation Choices › APF-Authorized Libraries › Controlling APF Authorization › APF Authorization of Linklist Modules

APF Authorization of Linklist Modules

The specification of which modules from linklist libraries (and LLA) are authorized when accessed through different types of allocations differs by z/OS release.

Modules in the LNKLST concatenation can execute without the libraries being specifically allocated to the job, much like LPA modules are available to all jobs.

The LLA facility improves performance by caching some LNKLST modules in storage. LNKLST modules are available to all jobs. Not all libraries in the LNKLST concatenation are necessarily authorized when accessed through the LNKL ST concatenation.

The LNKLSTxx parmlib members and the LNKAUTH parameter of the IEASYSxx parmlib member (and possibly the APFLSTxx members) determine whether a library’s modules are authorized when accessed this way. Authorized programs, while running, cannot usually load programs from an unauthorized library in the LNKLST concatenation.

z/OS behaves as if the unauthorized libraries in LNKLST were not in LNKLST. Libraries in the LNKLST concatenation must be cataloged in the master catalog. The contents of the libraries can be changed, and the changes reflected immediately (with execution of appropriate LLA commands) but the list of libraries in the LNKLST concatenation only changes at IPL. SYS1.LINKLIB always starts the LNKLST concatenation, followed by SYS1.MIGLIB and SYS1.CSSLIB, then the libraries specified in parmlib. LNKLST concatenation only changes at IPL. Unlike other concatenations, LNKLST can include unauthorized libraries while allowing authorized libraries in the concatenation to remain authorized. CA Auditor always knows which libraries are authorized through LNKLST now.

There are two different ways of executing these modules:

• When allocated through Joblib, Tasklib, or Steplib, the fact that they are in linklist libraries is irrelevant to authorization. When used this way, the APF list solely determines authorization.
• When executed from the LNKLST concatenation (or LLA), if the IEASYSxx parameter LNKAUTH=LNKLST, then all LNKLST modules are authorized when accessed through the LNKLST concatenation. If the IEASYSxx parameter LNKAUTH=APFTAB, then only modules in libraries in the APF list are authorized when accessed through the LNKLST concatenation.