Using the TBESAF99 Utility to Generate Security Profiles › Sample TBESAF99-Generated Control Statements for CA ACF2 › Sample Command Protection Control Statements for CA ACF2

Sample Command Protection Control Statements for CA ACF2

The following sample shows command protection control statements in TBESAF99 format.

BES1 TYPE=COMMAND,NAME=DISPLAY
BES2 TYPE=COMMAND,NAME=RELOAD
BES7 TYPE=COMMAND,NAME=REFRESH.KEYRINGS
BES7 TYPE=COMMAND,NAME=REFRESH.CAEKMAPI 

The following sample shows the resulting control statements generated by TBESAF99 for importing into CA ACF2. It defines the DISPLAY commands globally to the BES1 subsystem, the RELOAD commands to BES2, and the REFRESH=KEYRINGS command to BES7.

Note: These rule sets are defined within the OPERCMDS (CA ACF2 resource “OPR”).

//*+------ Define BES1 Commands -----+
//ACFBATCH EXEC PGM=ACFBCOMP,REGION=1M
//SYSUDUMP DD SYSOUT=*
//SYSPRINT DD SYSOUT=*
//RULES    DD  *
$KEY(BES1.DISPLAY) TYPE(OPR)
$OWNER(BES     )
 UID(uid-value) ALLOW
 UID(uid-value) PREVENT
/*
//*+------ Define BES2 Commands -----+
//ACFBATCH EXEC PGM=ACFBCOMP,REGION=1M
//SYSUDUMP DD SYSOUT=*
//SYSPRINT DD SYSOUT=*
//RULES    DD  *
$KEY(BES2.RELOAD) TYPE(OPR)
$OWNER(BES     )
 UID(uid-value) ALLOW
 UID(uid-value) PREVENT
/*
//*+------ Define BES7 Commands -----+
//ACFBATCH EXEC PGM=ACFBCOMP,REGION=1M
//SYSUDUMP DD SYSOUT=*
//SYSPRINT DD SYSOUT=*
//RULES    DD  *
$KEY(BES7.REFRESH.KEYRINGS) TYPE(OPR)
$OWNER(BES     )
 UID(uid-value) ALLOW
 UID(uid-value) PREVENT
$KEY(BES7.REFRESH.CAEKMAPI) TYPE(OPR) 
$OWNER(BES ) 
 UID(uid-value) ALLOW 
 UID(uid-value) PREVENT