7.8 z/OS Access Control

7.8 z/OS Access Control

1. Multi Level Security - Security Labels

   • A combination of security labels and zero or more security labels
     • See slide 19
     • Labels are applied to resources and in order to access that resource you must have that label
     • Labels cant be changed while the system is operating

2. Tables are used to modify the way access contol works

   • Global Access Table
     • Held in memory and used to speed up access checks.
       • For all files that everyone has access to you put an entry in the GAT
         • So you do not have to check the RACF database on disk
     • Bypasses RACF
       • Does not go through the global access list to check resources that are listed here
     • Can only grant access not deny it
     • If an access permission int he table is listed as 'none' then the instruction is to stop looking in the GAT and do a normal access check
     • All your own files are prefixed by your user id, if you put &USERID.* in the GAT then then user automatically gets instant access to all their own files without having to do an access check
   • Naming conventions table
     • Allows you to rename files to different names and then the table is used for mapping. Useful if you are merging systems with duplicate file names
     • Can be used for aliasing resources that have similar access requirements
   • Started Tasks Table
     • Procedure names in this table are given the name of the operator who starts the task
       • When an operator enters a command an access check is done to see if he can issue that command, in the same way the starting procedure can do it