Security Displays › Resources Section Detail Display › Resource-Value Field Values › Resource-Value Field Values for Basic Resource Types

Resource-Value Field Values for Basic Resource Types

The basic resources are either allowed or restricted. No actions can be specified for the resource.

The following lists the basic resources:

INVOKEKW

Specifies the allowed or restricted INVOKE command keywords. Specify an exact keyword or use an equal sign (=) at the end to specify a partial keyword.

The INVOKE command calls for the INVOKEKW resource to validate the external application that the user is trying to invoke. If the resource is not allowed, the user cannot invoke the application.

MENUKWD

Specifies the allowed or restricted menu panel names. Specify an exact keyword or use an equal sign (=) at the end of the value to specify a partial keyword.

The MENU member in the sysview.CNM4BPRM data set associates the name of a menu with a member name in the sysview.CNM4BPNL data set. For more details, see the MENU member in the data set sysview.CNM4BPRM.

If the menu panel is not authorized, it is not displayed as a selectable item on the Primary Option Menu.

MVSCMD

Specifies the allowed or restricted z/OS or JES commands. You can either specify an exact command or specify a partial command using * or =. For example, to specify all JES2 display commands, type $D=. To specify all commands, use = by itself. The z/OS and VTAM commands use this resource.

Command Validation

• For JES commands, all spaces are removed from the command before they are validated. For example, if a user enters the command $P JES2, then the command is changed to $PJES2 before validation. The space between the P and the J is removed.
• For MVS commands, multiple consecutive spaces are changed to one space before validation.

SETKWD

Specifies the allowed or restricted SET command keywords. Specify an exact keyword or use an equal sign (=) on the end to specify a partial keyword.

The SET command calls for the SETKWD resource.

The PROFILE command also calls for the SETKWD resource. Access to profile sections is controlled by validating access to the following SETKWD resources:

PROFGENPFKS

Displays the general PF key section

PROFGENMSCS

Displays the general miscellaneous section

PROFCMDSYNS

Displays the command synonym section

PROFCMDPFKS

Displays the command PF key section

PROFCMDMSCS

Displays the command miscellaneous section

PROFCMDFMTS

Displays the command format section

If the resource is not allowed, then the section is not displayed on the profile display. Individual fields within a profile section can also be controlled with the SETKWD resource. If the corresponding SETKWD resource for a field is restricted, then the field is displayed on the profile display, but it cannot be changed.

The PROFILE command also calls for the following SETKWD resources to control profile formats:

FORMATCREATE

Creates a format

FORMATMODIFY

Modifies an existing format

FORMATDELETE

Deletes a format

If the FORMATCREATE resource is not authorized, then formats cannot be created. However, the existing formats can be displayed. If the FORMATMODIFY resource is not authorized, then existing formats can be displayed but not modified. If the FORMATDELETE resource is not authorized, then formats cannot be deleted.

XSDATA

Specifies the allowed or restricted cross-system data commands. The complete list of cross-system eligible commands is shown on the XSCMDS display. Specify the exact command name (no synonyms or abbreviated command names). Masking is allowed in the command name. This resource call is only applicable if:

• The cross-system command has XSDATA set to YES.
• The command specified the XSDATA keyword when it was issued.