CA CSM Implementation and Status › Implementation Checklist › Security Administrator

Security Administrator

1. Grant UPDATE authority to the following data sets or libraries to the user who implements CA CSM:
   • SYSx.PARMLIB
   • Procedure library that stores the JCL jobs that are used to start the CA CSM address spaces, for example, SYS3.PROCLIB
   • (Optional) The master catalog if you decide to define alias entries for the CA CSM data set prefixes
2. Grant the following access to the user ID associated with the CA CSM setup utility, MSMSetup.sh:
   • Access to USS
   • Permission to access the following FACILITY class profiles that are related UNIX:
     • BPX.FILEATTR.APF (READ authority)
     • BPX.FILEATTR.PROGCTL (READ authority)
     • BPX.FILEATTR.SHARELIB (READ authority)
     • BPX.SERVER (UPDATE authority)
     • BPX.CONSOLE (READ authority)
   • Permission to access the SERVAUTH class profile, EZB.STACKACCESS (READ authority)
   • CA ACF2 for z/OS only: MUSASS permission for users who start CA CSM
   • If your site uses CA SAF HFS security, the following access:
     • BPX.CAHFS.SET.RLIMIT (READ authority)
     • BPX.CAHFS.PTRACE (READ authority)
     • BPX.CAHFS.MOUNT (READ authority)
     • BPX.CAHFS.UNMOUNT (READ authority)
     • BPX.CAHFS.CHANGE.FILE.MODE (READ authority)

       Note: CA SAF HFS security is a feature in CA ACF2 for z/OS and CA Top Secret for z/OS.

   • Permission to access the CSFSERV class profile, CSFOWH (READ authority) providing you want to perform SMP/E GIMUNZIP hash validation
   • Permission to create and modify data sets for the qualifiers (CA CSM MVS SMP/E and runtime data sets) specified in the options file.

     Note: Your user ID can have BPX.SUPERUSER access and it can switch to SUPERUSER. Then the switched SU ID requires a create and modify access to the MVS data set qualifiers specified in the options file.

   • If you are using IBM RACF, access to the following data sets for program control:
     • SYSx.MIGLIB
     • CEE.SCEERUN2
     • Members IEANTCR, IEANTDL, and IEANTRT of SYS1.CSSLIB
     • Member JVMLDM60 (for 31-bit Java 6.0) or JVMLDM66 (for 64-bit Java 6.0) of the data set where Java load modules are installed.

       Or

     • Member JVMLDM61 (for 31-bit Java 6.0.1) or JVMLDM67 (for 64-bit Java 6.0.1) of the data set where Java load modules are installed.

       Or

     • Member JVMLDM70 (for 31-bit Java 7.0.) or JVMLDM76 (for 64-bit Java 7.0)
     • (Optional) member IDIXCEE of SYS1.IDI.SIDIAUTH, only if you use IDIXCEE as an optional exit.

       Note: To display the resources, issue the RLIST command.

     You can set IBM RACF to control programs. If the resources do not exist, issue the following command:

     RDEFINE PROGRAM member ADDMEM('hlq.libraryname'//NOPADCHK) UACC(READ)
     

     For example:

     RDEFINE PROGRAM IEANTCR ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     If the resources exist, issue the following command:

     RALTER PROGRAM member ADDMEM('hlq.libraryname'//NOPADCHK) UACC(READ)
     

     For example:

     RALTER PROGRAM IEANTCR ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     Note: To set all members of a data set as a controlled program, replace the member name with an asterisk (*). For example:

     RDEFINE PROGRAM * ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     Important! If you are planning to use zFS, add IOE.SIOELMOD (or equivalent library) to program control.

3. Grant the following access to the user ID associated with the CA CSM application server (MSMTC job or started task):
   • Access to USS
   • Authority to create and mount file systems
   • Permission to access the following FACILITY class profiles that are related UNIX:
     • BPX.FILEATTR.APF (READ authority)
     • BPX.FILEATTR.PROGCTL (READ authority)
     • BPX.FILEATTR.SHARELIB (READ authority)
     • BPX.SERVER (UPDATE authority)
     • BPX.CONSOLE (READ authority)
   • Permission to access the SERVAUTH class profile, EZB.STACKACCESS (READ authority)
4. Set up OMVS segments for CA CSM users.