File Management - IBM

Table 5. Data Authority Required for File Operations
Function Execute Read Add Update Delete
Open, I/O, close file 1
X X 2
X 3
X 3
Compile a program
using the file description
X
Run a program or locate
an object in a library
X
Display file description X
Replace file X
Add or remove triggers 4
X X 5
X 6
X 7
:
1
2
3
4
5
6
7
For device files that are not using spooling, you must also have object operational and all data authorities to
the device.
Open for output for database and save files.
Open for update or delete for database files.
For database files only.
Add authority required in addition to Read authority for inserting triggers.
Update authority required in addition to Read authority for updating triggers.
Delete authority required in addition to Read authority for deleting triggers.
Limiting access to files and data when creating files
Specifying authorities allows you to control access to a file.
Specifying authorities when creating files:
To specify public authority when you create a file, use the AUT parameter on the
create command.
What public authority is:
Public authority is authority that is available to any user who does not have
specific authority to the file or who is not a member of a group that has specific
authority to the file. That is, if the user has specific authority to a file or the user is
a member of a group with specific authority, then the public authority is not
checked when a user performs an operation to the file. Public authority can be
specified as:
v *LIBCRTAUT. All users that do not have specific user or group authority to the
file have authority determined by the library in which the file is being created.
The library value is specified by the *CRTAUT command to establish a public
authority for this library.
v *CHANGE. All users that do not have specific user or group authority to the file
have authority to use the file. The *CHANGE value is the default public
authority. *CHANGE grants any user object operational and all data authorities.
v *USE. All users that do not have specific user or group authority to the file have
authority to use the file. *USE grants any user object operational, execute, and
read data authority.
v *EXCLUDE. Only the owner, security officer, users with specific authority, or
users who are members of a group with specific authority can change or use the
file.
Chapter 2. File processing 11