Previous Topic: CA SAF HFS ADD/PERMIT Generation UtilityNext Topic: CA SAF HFS ADD/PERMIT Generation Utility


File Protection Procedure

Use this procedure to protect your current file system:

  1. Run the OMVS “ls lRA” command in a batch TMP. Direct the output to a standard DASD file. This file must be allocated with RECFM=VB.

    Issue the ls command from the OMVS shell, directing the output to a HFS file. The options ‑lRA must be specified (the character following the dash is a lower case letter ‘L’, not the number one). The file can then be copied into a MVS data set using the OGET command. For example:

    ls  ‑lRA  /  >>directory_information_file
    OGET ‘/directory_information_file’ ‘mvs.input.file’
    The resulting file data should look similar to this:
    /:                                                            
    total 232                                                     
    drwx‑‑‑‑‑‑   3 USER     OPENMVS        0 Jun  3  1998 JavaS390
    drwxr‑xr‑x   4 USER                    0 May  7  1998 bin     
    drwx‑‑x‑‑x   2 USER     OPENMVS        0 Oct  1  1997 dev     
    drwxr‑xr‑x   8 USER     OPENMVS        0 Nov  4 17:05 etc     
    drwxr‑xr‑x   2 USER                    0 Jan 20  1998 lib     
    drwxrwxrwx   2 USER                    0 Jan 19 11:51 tmp     
    drwxr‑xr‑x   8 USER     OPENMVS        0 Jan 15 15:47 u       
    drwxr‑xr‑x  11 USER                    0 Jan 20  1998 usr     
                                                                  
    /JavaS390:
    total 16                                                      
    drwxrwxrwx   7 USER     ZEROGRP        0 Sep 25  1997 J1.1.1
    
  2. Run HFSPASS1.

    This job reads the file from the previous step, creates and intermediate data set and then sort that data creating a file for the next step.

    //        JOB
    //STEP1   EXEC PGM=HFSUTIL1,REGION=0M                                      
    //SYSABEND DD SYSOUT=*                                                     
    //SYSUDUMP DD SYSOUT=*                                                     
    //HFSINPUT DD DSN=????.????.????,DISP=SHR                                  
    //EXTRACT  DD DSN= SORT.INPUT,UNIT=3390,
    //        DISP=(NEW,CATLG,DELETE),SPACE=(TRK,(15,1),RLSE),                 
    //        DCB=(RECFM=FB,LRECL=300,BLKSIZE=6000)                            
    /*                                                                         
    //STEP2   EXEC PGM=SORT,REGION=0M                                          
    //SYSOUT  DD SYSOUT=*                                                      
    //SORTWK01  DD UNIT=3390,SPACE=(CYL,5)                                     
    //SORTWK02  DD UNIT=3390,SPACE=(CYL,5)                                     
    //SORTWK03  DD UNIT=3390,SPACE=(CYL,5)                                     
    //SORTWK04  DD UNIT=3390,SPACE=(CYL,5)                                     
    //SORTIN    DD DSN=SORT.INPUT,DISP=(OLD,DELETE,KEEP)                       
    //SORTOUT   DD DSN=SORT.OUTPUT,UNIT=3390,                                  
    //         DISP=(NEW,CATLG,DELETE),SPACE=(TRK,(15,1),RLSE),                
    //         DCB=(RECFM=FB,LRECL=300,BLKSIZE=6000),VOL=SER=SCAC16            
    //SYSIN     DD *                                                           
     SORT FIELDS=(1,264,CH,A)                                                  
    /*     
    
  3. (Optional) Alternatively, the input file from the first step can point directly to the directory information file created from the ls command.

    If using this format, the LRECL value specified in the JCL must be at least as large as the largest record in the file. The BLKSIZE value should be a value at least 8 greater than the LRECL. The PATH name must be the full path name of the file containing the directory information. A sample statement follows:

    //HFSINPUT  DD   PATH=‘/directory_information_file’,
    //               PATHOPTS=(ORDONLY),FILEDATA=TEXT,
    //               RECFM=VB,LRECL=nnn,BLKSIZE=nnn
    
  4. Edit the file created in step 2:

    a. At the beginning of the data set are records to build a /group profile cross‑reference table. The formats of those records are:

    AAAAAAAA ‑ xxxxxxxx

    where AAAAAAAA is the name of an OMVS group

    Change xxxxxxxx to a profile to be used for any permissions needed by this group. In our example OPENMVS is the group and you must assign a profile name to “xxxxxxxx”.

    This is not a complete list of all groups, only those ACIDs that needs a specific permission given.

    b. After those records are several TSS ADD or TSS ADDTO commands. These are all of the ownership’s that are required for the conversion to meet with success. In these statements the xxxxxxxx (ACID name) needs to be modified to whatever ACID the client wants to own the specified resources.

    OPENMVS  ‑ xxxxxxxx                                                   
    TSS ADD(xxxxxxxx) HFSSEC(ROOT)                                        
    TSS ADD(xxxxxxxx) IBMFAC(BPX.CAHF)                                    
    TSS ADD(xxxxxxxx) HFSSEC(/bin)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/dev)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/etc)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/lib)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/opt)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/samples)                                  
    TSS ADD(xxxxxxxx) HFSSEC(/tmp)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/u)                                        
    TSS ADD(xxxxxxxx) HFSSEC(/usr)                                      
    TSS ADD(xxxxxxxx) HFSSEC(/JavaS390)                                 
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.ATTRIBUTES)        
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.AUDIT.FLAGS)       
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.FORMAT)            
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.GROUP)             
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.EGID)         
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.EUID)         
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.STICKY)       
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE)              
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.OWNER)             
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.TIME)              
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.PRIORITY)               
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.EXTERNAL.LINK)          
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.LINK)                   
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.SYMBOLIC.LINK)          
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.MOUNT)                         
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.PTRACE)                        
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.SET.PRIORITRY)                 
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.SET.RLIMIT)                    
    TSS PER(ALL) FOR(14) IBMFAC(BPX.CAHFS.UNMOUNT)                       
    TSS PER(ALL) HFSSEC(ROOT) ACCESS(READ)                               
    ALL     //bin                                                          
    ALL     //dev                                                          
    ALL     //etc                                                          
    ALL     //lib                                                          
    ALL     //opt
    
  5. Run HFSPASS2.

    HFSPASS2 reads the edited data set and produces a data set containing all the TSS commands to be executed. For example:

    //        JOB
    //STEP3   EXEC PGM=HFSUTIL2,REGION=0M                             //SYSABEND DD SYSOUT=*                                           
    //SYSUDUMP DD SYSOUT=*                                           
    //EXTRACT  DD DSN=SORT.OUTPUT,DISP=SHR                           
    //PRMOUT   DD DSN=TSS.CMDS,UNIT=3390,VOL=SER=SCAC16,             
    //         DISP=(NEW,CATLG,DELETE),SPACE=(TRK,(15,1),RLSE),      
    //         DCB=(RECFM=FB,LRECL=300,BLKSIZE=6000)                 
    Example 2.1  Output from the HFSUTIL2
    TSS ADD(xxxxxxxx) HFSSEC(ROOT)                                   
    TSS ADD(xxxxxxxx) IBMFAC(BPX.CAHF)                               
    TSS ADDTO(xxxxxxxx) HFSSEC(/bin)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/dev)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/etc)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/lib)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/opt)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/samples)                             
    TSS ADDTO(xxxxxxxx) HFSSEC(/tmp)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/u)                                   
    TSS ADDTO(xxxxxxxx) HFSSEC(/usr)                                 
    TSS ADDTO(xxxxxxxx) HFSSEC(/JavaS390)                            
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.ATTRIBUTES)   
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.AUDIT.FLAGS)  
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.FORMAT)       
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.GROUP)        
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.EGID)    
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.EUID)    
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE.STICKY)  
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.MODE)         
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.OWNER)        
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.FILE.TIME)         
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CHANGE.PRIORITY)          
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.EXTERNAL.LINK)     
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.LINK)              
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.CREATE.SYMBOLIC.LINK)     
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.MOUNT)                    
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.PTRACE)                   
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.SET.PRIORITRY)            
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.SET.RLIMIT)               
    TSS PERM(ALL) FOR(14) IBMFAC(BPX.CAHFS.UNMOUNT)                  
    TSS PERM(ALL) HFSSEC(ROOT) ACCESS(READ)                          
    TSS PERMIT(ALL) HFSSEC(/bin) ACCESS(READ,EXEC)                   
    TSS PERMIT(ALL) HFSSEC(/dev) ACCESS(EXEC)                        
    TSS PERMIT(ALL) HFSSEC(/etc) ACCESS(READ,EXEC)                   
    TSS PERMIT(ALL) HFSSEC(/lib) ACCESS(READ,EXEC)                   
    TSS PERMIT(ALL) HFSSEC(/opt) ACCESS(READ,EXEC)                   
    TSS PERMIT(ALL) HFSSEC(/samples) ACCESS(READ,EXEC)   
    
  6. Run REXX exec to execute the commands in the data set.
    /*   REXX   */                                                       
    /*                                                                   
         This EXEC will have as input a dataset name and will read      
         that dataset and issue the TSS commands in it.                  
    */            
      arg dsn .                  /*  get data set name                 */
      if dsn = ‘‘ then dsn = ‘????.?????.????’                          
      ‘ALLOC FI(PERMIN) DS(‘‘‘dsn’’’) SHR REUSE VOL(??????)’             
      eof = ‘no’                                                         
      do while eof = ‘no’                                                
        ‘execio 1 diskr PERMIN’                                          
        if rc = 2                                                        
           then do                                                       
              eof = ‘yes’                                                
              end                                                        
           else do                                                       
              pull record                                                
              say ‘Record is: ‘ record                                   
              record                                                     
              end                                                        
      end                                                                
        ‘execio 1 diskr permin ( finis’                                  
        ‘FREE FI(PERMIN)’                                                
      exit 0