Implementing Security for DFSMS › Understanding the DFSMS Classes and Attributes

Understanding the DFSMS Classes and Attributes

SMS resource protection is provided through four existing classes:

FACILITY

Controls the use of catalog, IDCAMS, and DFDSS functions against SMS managed volumes. This class is administered as class IBMFAC in CA Top Secret to avoid confusion with the CA Top Secret FACILITY concept. These new calls supercede the FACILITY resource name of IGG.CATLOCK previously introduced for controlling catalog access.

PROGRAM

Controls the use of DFSMS programs. This is used in exactly the same manner as program protection with CA Top Secret. The programs invoked for the various DFSMS ISMF functions may be protected as programs by their program name.

STORCLAS

Controls user access to a specific storage class defined by the storage administrator. Each unique storage class is identified by a unique one‑ to eight‑byte name.

MGMTCLAS

Controls user access to a management class defined by the storage administrator. Each unique management class is identified by a unique one‑ to eight‑byte name.

In addition, four ACID attributes for default data class name, default management class name, default storage class name, and default application identifier, have been added to CA Top Secret. These attributes are tested by the DFSMS Automatic Class Selection (ACS) routines to obtain this information. To administer these SMS resources and attributes, the administrator needs MISC2 authority. For information, see the Command Functions Guide.