Resources › CPCMD Resource Class—Secure CP Commands

CPCMD Resource Class—Secure CP Commands

Valid on z/VM.

Use CPCMD to secures CP commands issued on z/ VM.

When used with TSS ADDTO/REMOVE, this resource class has the following format:

TSS ADDTO(acid) CPCMD(command,command,...)

Prefix length

One to eight characters

Capacity of list

One to five CP command per TSS command

When used with TSS PERMIT/REVOKE, this resource class has the following format:

TSS PERMIT(acid) CPCMD(command,command,...)

Prefix length

One to eight characters

Capacity of list

One to five CP commands per TSS command

CPCMD is used with:

• The commands CREATE, ADDTO, REMOVE, PERMIT, REVOKE, ADMIN, DEADMIN, WHOOWNS, and WHOHAS
• The ACID types User, Profile, Department, Division, Zone, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS ADD/REMOVE
• The ACID types User, Profile, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS PERMIT/REVOKE
• CPCMD(OWN) authority to ADDTO or REMOVE ownership of CPCMDs from ACIDs
• CPCMD(XAUTH) authority to PERMIT or REVOKE access to CPCMDs

The administrator can use any of the following methods to control access to CPCMDs: Expiration, Facility, Time/Day, and Actions. The CPCMD resource also supports use of the ACTION(VMPRIV) attribute.

Examples: CPCMD resource class

This example protects the CP command, SHUTDOWN, by assigning ownership to the Operations Department:

TSS ADDTO(OPERDEPT) CPCMD(SHUTDOWN)

The administrator may now PERMIT limited access to users or to profiles that require access.

This example removes ownership of CP commands:

TSS REMOVE(OPERDEPT) CPCMD(SHUTDOWN)

This example permits USER03 to use the CP command QUERY, to get a listing of real DASD on the real computer:

TSS PERMIT(USER03) CPCMD(QUERY.DASD)
                   ACTION(VMPRIV)

If ACTION(VMPRIV) was not specified, USER03 would have gotten a listing of virtual DASD on his virtual machine.

This example permits USER03 to use the CP command, SHUTDOWN:

TSS PERMIT(USER03) CPCMD(SHUTDOWN)

In this example, VMPRIV is implied.

This example revokes USER03's permission to use SHUTDOWN:

TSS REVOKE(USER03) CPCMD(SHUTDOWN)