Security with the Rules Facility › System Rules

System Rules

System rules take precedence over other rules. You can use system rules to:

• Define authorizations for service virtual machines. For example, you can set up rules that allow CA VM:Backup to link to all minidisks and rules that allow CA VM:Schedule to autolog any user ID without supplying the logon password.
• Establish common rules for all user IDs. This reduces rule redundancy and expedites rule processing.
• Establish rules that cannot be overridden by security group managers or users. For example, the following system–level rule restricts all users from linking with link mode MW:

  REJECT * LINK * MW
  

• Establish rules for the CP TAG and STORE HOST commands. These rules can be defined only at the system level (override or default).

To create system‑level rules, enter the following:

vmsecure rules system

For example, the System Rules File example below illustrates a sample system rules file. Based on this rules file, user ID VMBACKUP can link to any minidisk without a password and spool to any virtual machine, and the target user ID’s history statements are updated. User IDs VMSCHED, AUTOLOG1, MAINT, and VTAM can autolog any virtual machine without a password. User ID VMANAGER can link to any minidisk without a password until 8 p.m. on the specified mm/dd/yy. All user IDs are prevented from issuing the LINK command with an MW link mode. All user IDs can use the CP TAG command.