ATTR Keyword with the RDT—Resource Attributes

Keywords › ATTR Keyword with the RDT—Resource Attributes

ATTR Keyword with the RDT—Resource Attributes

Valid on z/OS, z/VSE, and z/VM.

Use the ATTR keyword to define or change a resource to the RDT Record with one or more attributes.

This keyword has the following format:

TSS ADDTO(RDT) RESCLASS(resource Type)
               RESCODE(hex code)
               ATTR(attribute)

This keyword is used with:

The commands ADDTO and REPLACE
The RDT and FDT records
MISC1(RDT) authority

Attributes

When used with the RDT, the following attributes can be used:

EXIT

Calls the installation exit for this resource class.

NOEXIT

Deactivates the installation exit.

DEFPROT

Protects this resource class by default.

NODEFPROT

Deactivates default protection.

GENERIC

Supports generic prefixing for this resource class.

NONGENERIC

Changes a generic attribute to a non‑generic one. A non‑generic attribute only supports general resources (resources which do not support masking). It treats the specific resources within the resource class as fully qualified names. EXIT, DEFPROT, MERGE, ALLMERGE, and GENERIC are the only site modifiable attributes which can be changed for predefined resources.

PRIVPGM

Supports privileged program for this resource class.

NOPRIVPGM

Deactivates privileged program support.

LIBRARY

DATASET only. Restricts both the program allowed to access the data set, as well as the library from which the program is fetched.

NOLIB

PIE only. Deactivates support for a library with privileged program.

LONG

Equivalent to MAXLEN(44): indicates that the maximum length resource name for PERMIT with this RESCLASS is 44.

SHORT

(default) Equivalent to MAXLEN(8): indicates that the maximum length resource name for PERMIT with this RESCLASS is 8.

MERGE

Overrides the AUTH control option and uses the MERGE algorithm to determine the processing record for security validation of this RESCLASS.

NOMERGE

Removes the MERGE attribute from the resource.

ALLMERGE

Overrides the AUTH control option and uses the MERGE algorithm to determine the processing record for security validation of this RESCLASS.

NOALLMERGE

Removes the ALLMERGE attribute from the resource.

VMUSER

Supports VMUSER for this resource class

NOVMUSER

Deactivates VMUSER support.

MASK

Allows the interpretation of MASK characters for this resource class in any facility set with the RES sub-option.

Altering a resource class to MASK from NOMASK makes existing resources un-administrable. Before making such a change, it is recommended that all existing permissions and ownerships be revoked and removed, then re-administered after the attribute change.

NOMASK

Prevents the interpretation of MASK characters in this resource class.

To pick up any permits on any acids in storage, including the ALL record, after altering NOMASK to MASK, refresh the acids. To refresh the ALL record, issue a dummy PERMIT command against the ALL record and then REVOKE the permit. To refresh a user acid in all address spaces where the user is signed on, enter:

TSS REFRESH(acid) JOBNAME(*).

SIGNAL

Specifies that CA Top Secret will issue an ENF62 signal when you add or remove ownership of this resclass to an ACID.

NOSIGNAL

Deactivates the SIGNAL for a resource class.

For PRIVPGM, LIBRARY, and VMUSER the security driver must also support these features. For a user‑defined resource, the software that generates the security calls must supply additional parameters in order to satisfy PRIVPGM, LIBRARY, and VMUSER restrictions.

Notes:

All of the operands used to deactivate an attribute can only be used with a TSS REPLACE(RDT) command function.
The following default attributes are in effect when adding user—defined resource classes to the RDT using a RESCODE of 101—13F unless the corresponding overriding attribute is specified: MASK, NOEXIT, NODEFPROT, NOPRIVPGM, NOMERGE, NOALLMERGE, NOVMUSER, and GENERIC.
The following default attributes are in effect when adding user—defined resource classes to the RDT using a RESCODE of 01—3F unless the corresponding overriding attribute is specified: NOMASK, NOEXIT, NODEFPROT, NOPRIVPGM, NOMERGE, ALLMERGE, NOVMUSER,GENERIC, and SHORT.
If you defined a resource as maskable, all those currently signed on users with that permitted resource type will start to fail. Those users will have to refresh their security environments. The change to the RDT not only sets up for the new permissions but causes all of the security validations to treat that class as maskable. Those that logged on before the switch have the wrong internal record format and are required to refresh or log off and log on.
For predefined resource classes, only EXIT, DEFPROT, MERGE, ALLMERGE, and GENERIC attributes can be changed.
If mixed case is used for the HFSSEC resource class, when issuing a TSS WHOHAS for the HFSSEC resource, the case on the WHOHAS command must match the case in the HFSSEC resource on the acid in order for that data to be displayed. The same is true for TSS WHOOWNS.
For the EXIT attribute to take effect the global control option EXIT(ON) must be set.
For PRIVPGM, LIB, and VMUSER the security driver must also support these features. For a user‑defined resource, the software that generates the security calls must supply additional parameters in order to satisfy PRIVPGM, LIB, and VMUSER restrictions.
If mixed case is used for the FDT field, when issuing a TSS WHOHAS for the FDT field, the case on the WHOHAS command must match the case in the FDT data on the acid in order for that data displayed.

Examples: ATTR keyword

This example adds #PRODUCT to the RDT Record and gives it default protection:

TSS ADDTO(RDT) RESCLASS(#PRODUCT)
               RESCODE(002) 
               ATTR(DEFPROT)

This example removes default protection from resource class #PRODUCT:

TSS REPLACE(RDT) RESCLASS(#PRODUCT)
                 ATTR(NODEFPROT)

This examples indicates SIGNAL=YES on the DATASET resclass, which tells the command processor to issue the enf62 signal to CSF when a DATASET is added or removed:

TSS REP(RDT) RESCLASS(DATASET) ATTR(SIGNAL)

To remove the LONG attribute which is already attached to a specific resource class, specify ATTR(SHORT).