Securing Resources › VM Protection Examples › Control Program (CP) Commands Protection

Control Program (CP) Commands Protection

In CA Top Secret, Control Program (CP) commands are grouped into three categories:

• General user commands—A general user command is one that only requires a class G user status in a standard VM operating system environment, and one that means only one thing to all users. For example, the SPOOL command would perform the same function regardless of whether is was issued by a user with a class B or a class G status. Other examples of general user commands include LINK, TAG, SEND.

  By PERMITting ACIDs to use these general commands, the CA Top Secret administrator gives access rights similar to rights accorded class G VM users.

  Privileged commands—Like general user commands, privileged commands also perform the same function regardless of the user’s class status. Unlike general user commands, only a few select users are given the class that allows them to use these privileged commands. Examples of privileged commands include ATTACH, SHUTDOWN, NETWORK, STORE HOST

  In a native VM environment, these commands require a specific class, other than class G. Such commands are considered by CA Top Secret to have implied VMPRIVilege access rights. If USER01 is PERMITted to the CP command SHUTDOWN, CA Top Secret makes USER01 a privileged VM user of that command only—whether VM allows it or not.

• Mixed commands—Unlike the previous command types, these commands do perform different functions depending on the class of the user who issues them. For example, a class B user who types in QUERY DASD receives information about the real DASD associated with the real CPU while a class G user who types in the same QUERY DASD command receives information about the virtual DASD associated with his virtual machines. Another example of mixed commands is SET.

Note: In FAIL mode,CA Top Secret authorizations supersede VM’s privilege classes.