2. PLANNING › 2.5 Special Considerations › 2.5.2 Security Package Considerations

2.5.2 Security Package Considerations

 VCC allocates and opens ICF and VSAM catalogs, VVDSs, and
 OS/VTOCs. Enterprise Security packages such as IBM's RACF,
 CA Top Secret, and CA ACF2 provide open exits that match the
 name of the data set being opened against a list of
 restricted names defined by your security officer. Quite
 often names of the aforementioned special data sets are in a
 list of secured names, which means that normal VSAM password
 protection functions are bypassed and handled instead by the
 security package.

 Note: To avoid security violations, you must thoroughly
 research the security in force for VSAM and ICF catalogs and
 VTOCs (if applicable) to ensure that the user ID under which
 the VCC scan is run has READ access to the names of the
 catalogs and VTOCs that VCC will be scanning. The user ID
 must also have read access to all PDSEs on which it will be
 collecting data. If HSM=Y is coded in the runtime parameters,
 the user ID under which the scan is run must have read access
 to the MCDS and BCDS that the scan job is accessing.

 VCC uses the Callable Assembler Interface to UNIX System
 Services to scan the Hierarchial File Systems. In order to
 access UNIX System Services, the userid assigned to the batch
 job must be defined to UNIX System Services security. The
 userid must be assigned a UNIX userid, a groupid, and a home
 directory. See the appropriate security product's manuals for
 additional information.

 Prior to scanning the mounted Hierarchial File Systems, VCC
 issues the function SETUID(0) (set USERID to SUPERUSER) in
 order to ensure having read access to all the files within
 the HFS structure. In order to function properly, VCC must
 have authority to the BPX.SUPERUSER resource in the FACILITY
 class. This will allow the SETUID(0) to function
 successfully.

 For the IBM z/OS Security Server RACF, see the IBM manual
 "UNIX System Services Planning" Chapter 16, (Establishing
 UNIX Security) for additional information. Review the
 sections of chapter 16 relating to BPX.SUPERUSER, Assigning
 Superuser Attributes, Using UNIXPRIV Class Profiles, and
 Setting up The BPX.* FACILITY Class Profiles BPX.SUPERUSER.
 For CA ACF2, the userid that is assigned to the batch job
 must be defined to CA ACF2 Unix System Services Security. See
 the CA ACF2 Administrator Guide, chapter 21 (z/OS UNIX System
 Services Support) for information about defining a
 userid and setting up the ability to execute the setuid(0)
 function.

 For CA Top Secret, the userid that is assigned to the batch
 job must be defined to CA Top Secret Unix System Services
 Security. See the CA Top Secret documentation for information
 about defining a userid and setting up the ability to execute
 the setuid(0) function.