System Installation Choices › APF-Authorized Libraries › Controlling APF Authorization › APF Authorization of LPA Modules

APF Authorization of LPA Modules

Specification of the libraries z/OS uses at IPL to load the link pack area (LPA) differs in each z/OS release, but the LPA modules are always APF‑authorized when executed in LPA. On recent systems, during an IPL with the CLPA parameter, z/OS opens the LPALST concatenation to create LPA.

The system always begins the LPALST concatenation with the SYS1.LPALIB data set first. SYS1.LPALIB is always considered authorized when it begins the LPALST concatenation during IPL (but SYS1.LPALIB is not necessarily authorized after IPL). All other LPA libraries must be in the APF list to successfully create LPA; otherwise only SYS1.LPALST is used.

After IPL, all programs that reside in LPA are considered APF‑authorized when executed in LPA (not allocated through joblib, steplib, or tasklib). However, if a program is added to SYS1.LPALIB after IPL, that does not necessarily cause the program to be authorized when executed from the library through allocation to Joblib, Steplib, or Tasklib (though it becomes authorized when executed in LPA after the next IPL with the CLPA parameter).

PLPA libraries must be cataloged and must be APF‑authorized to be specified for MLPA or FLPA. There are system parameters that can prevent or allow page protection of the FLPA and PLPA modules. This prevents the reentrant LPA programs from being modified by themselves or other authorized programs. See the IBM Initialization and Tuning Reference for more information about authorization under IEASYSxx, IEALPAxx and IEAFIXxx. PLPA libraries are specified in the LPALSTxx member of parmlib.

There are different considerations for whether modules from LPA libraries become authorized when loaded for execution through different types of allocations:

• When loaded through an allocation to Joblib, Tasklib, or Steplib, the fact that they are in LPA libraries is irrelevant to their APF authorization. When used this way, authorization is determined only by whether they are also in the APF list.
• When executed in LPA, all LPA modules are authorized.