XCOMMAND Keyword—Command Restrictions

Valid on z/OS.

Use the XCOMMAND keyword to prevent ACIDs from using a specified command or subset of commands available within that facility.

This keyword has the following format:

TSS ADDTO(acid) XCOMMAND(facility,(cmdname[(G)]))

For purposes of LCF protection, facility entities USER77 through USER221 are not considered unique.

Prefix length: One to eight characters. Entries are treated as prefixes only if the generic indicator (G) follows the entry.
Capacity of list: One to 30 command names or prefixes per CA Top Secret command.

This keyword is used with:

The commands CREATE, REPLACE, ADDTO, and REMOVE
The ACID types User, Profile, DCA, VCA, ZCA, LSCA, SCA, MSCA, and ALL Record
MISC1(LCF) authority to ADDTO or REMOVE the XCOMMAND keyword from ACIDs
MISC9(GLOBAL) authority to ADDTO or REMOVE the XCOMMAND resource class to or from the ALL record

This example allows users attached to PROF01 to execute all TSO ISPF commands except for the SPF panels 3.4 and 3.5:

TSS ADDTO(PROF01) XCOMMAND(TSO,(SPF34,SPF35))

The letter G next to the command prefix indicates that the ACID is prohibited from using a command beginning with the prefix specified.

This example indicates that user EJ001 cannot use TSO commands prefixed by SPF or any IBM defined SPF panels:

TSS ADDTO(EJ001) XCOMMAND(TSO,(SPF(G)))

To restrict the use of batch programs:

TSS ADDTO(USER07) XCOMMAND(BATCH,(PROG57))

To restrict all users from commands used in a specific facility:

TSS ADDTO(ALL) XCOMMAND(facility,(commands...))

To remove the XCOMMAND restriction:

TSS REMOVE(EJ001) XCOMMAND(TSO,(SPF(G)))