Keywords › COMMAND Keyword—Specific Commands for ACID

COMMAND Keyword—Specific Commands for ACID

Valid on z/OS.

Use the COMMAND keyword to confine ACIDs to using a specific command or subset of commands available within a facility.

For purposes of LCF protection, facility entities USER77 through USER221 are not considered unique.

For information on how to allow an ACID to use all but a specific list of commands for a particular facility, see the XCOMMAND keyword.

The TSO TEST command might not be entered as an operand of the COMMAND keyword. Restricting ACIDs to the TSO TEST command allows the ACID to execute any TSO command via the TEST, LOAD, and GO sub-commands.

This keyword has the following format:

TSS ADDTO(acid) COMMAND(facility,(command[(G,V)]))

Facility

Specifies the facility commands are restricted to.

Command

Specifies the commands available to the user.

Length: 1 to 8 characters

Capacity: 1 to 30 commands

G

Indicates that the ACID can use any command beginning with the generic prefix specified.

V

Indicates that the ACID may use the command listed, but CA Top Secret will reverify the ACID's password.

This keyword is used with:

• The commands CREATE, ADDTO, and REMOVE
• The ACID types User, Profile, DCA, VCA, ZCA, LSCA, SCA, MSCA, and ALL Record
• MISC1(LCF) authority to ADDTO or REMOVE the COMMAND keyword from ACIDs
• MISC9(GLOBAL) authority to ADDTO or REMOVE the COMMAND resource class to the ALL record

Examples: COMMAND keyword

This example restricts a user (RABBIT) to TSO commands OPER and ACCT:

TSS ADDTO(RABBIT) COMMAND(TSO,(OPER,ACCT))

Note that the use of LCF (whether inclusive or exclusive) will not negate the controls, provided via TSO UADS, or the TSOAUTH resource of the OPER and ACCT commands. CA Top Secret will provide additional protection for these commands.

COMMAND(fac,(cmd(G)...)

This example indicates that user EJ001 can only use TSO commands prefixed by SPF:

TSS ADDTO(EJ001) COMMAND(TSO,(SPF(G)))

This example removes a command confinement from an ACID:

TSS REMOVE(RABBIT) COMMAND(TSO,(OPER,ACCT))

This example confines all users to commands within a specific facility:

TSS ADDTO(ALL) COMMAND(fac,(cmds...))

This example confines users to programs within the BATCH facility:

TSS ADDTO(acid) COMMAND(BATCH,(programs...))

This example confines users to specific SPF panels within TSO:

TSS ADDTO(acid) COMMAND(TSO,(SPFn,...))

n is equal to an SPF menu number. The VTOC menu (SPF 3.7) is entered as CMD(TSO,(SPF37)).