Set Up Security › Access Requirements to Download, Install, and Set Up CA CSM

Access Requirements to Download, Install, and Set Up CA CSM

To download, install, and to set up CA CSM, your security administrator must configure the following access authorities on your system:

1. Access to UNIX System Services (USS) for downloads and the implementation of CA CSM:

   If you decide to create and mount new file systems for CA CSM, you need one of the following authorities:

   • If your site uses CA SAF HFS security, BPX.CAHFS.CHANGE.FILE.ATTRIBUTES
   • If your site does not use CA SAF HFS security, UID(0) or BPX.SUPERUSER authority

   Note: CA SAF HFS security is a feature in CA ACF2 for z/OS and CA Top Secret for z/OS.

2. UPDATE authority to the following data sets or libraries for the user implementing CA CSM:
   • SYSx.PARMLIB
   • Procedure library that stores the JCL jobs that are used to start the CA CSM address spaces, for example, SYS3.PROCLIB
   • (Optional) The master catalog if you decide to define alias entries for the CA CSM data set prefixes
3. Access for the user ID associated with the CA CSM setup utility:
   • Permission to access the following FACILITY class profiles that are related to UNIX:
     • BPX.FILEATTR.APF (READ authority)
     • BPX.FILEATTR.PROGCTL (READ authority)
     • BPX.FILEATTR.SHARELIB (READ authority)
     • BPX.DAEMON (READ authority)
     • BPX.SERVER (UPDATE authority)
     • BPX.CONSOLE (READ authority)
   • Permission to access the SERVAUTH class profile, EZB.STACKACCESS (READ authority)
   • Permission to access the CSFSERV class profile, CSFOWH (READ authority) providing you want to perform SMP/E GIMUNZIP hash validation
   • Permission to create and modify data sets for the qualifiers (CA CSM MVS SMP/E and runtime data sets) specified in the options file.

     Note: Your user ID can have BPX.SUPERUSER access and it can switch to SUPERUSER. Then the switched SU ID requires a create and modify access to the MVS data set qualifiers specified in the options file.

   • If you are using IBM RACF, access to the following data sets for program control:
     • SYSx.MIGLIB
     • CEE.SCEERUN2
     • Members IEANTCR, IEANTDL, and IEANTRT of SYS1.CSSLIB
     • Member JVMLDM60 (for 31-bit Java 6.0) or JVMLDM66 (for 64-bit Java 6.0) of the data set where Java load modules are installed.

       Or

     • Member JVMLDM61 (for 31-bit Java 6.0.1) or JVMLDM67 (for 64-bit Java 6.0.1) of the data set where Java load modules are installed.

       Or

     • Member JVMLDM70 (for 31-bit Java 7.0.) or JVMLDM76 (for 64-bit Java 7.0)
     • (Optional) member IDIXCEE of SYS1.IDI.SIDIAUTH, only if you use IDIXCEE as an optional exit.

     Note: To display the resources, issue the RLIST command.

     You can set IBM RACF to control programs. If the resources do not exist, issue the following command:

     RDEFINE PROGRAM member ADDMEM('hlq.libraryname'//NOPADCHK) UACC(READ)
     

     For example:

     RDEFINE PROGRAM IEANTCR ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     If the resources exist, issue the following command:

     RALTER PROGRAM member ADDMEM('hlq.libraryname'//NOPADCHK) UACC(READ)
     

     For example:

     RALTER PROGRAM IEANTCR ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     Note: To set all members of a data set as a controlled program, replace the member name with an asterisk (*). For example:

     RDEFINE PROGRAM * ADDMEM('SYS1.CSSLIB'//NOPADCHK) UACC(READ)
     

     Important! If you are planning to use zFS, add IOE.SIOELMOD (or equivalent library) to program control.