eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Controlling HFS Using CA SAF HFS SecurityPath Name TranslationA path name can be up to 1023 characters in length, except when used in the JCLPATH= keyword where the limit is 255 characters. The path name is also casesensitive and can contain special characters. In order to allow external securityto validate HFS files, eTrust CA-Top Secret validation of HFS files requires pathname manipulation.Before validation, all path names are converted to upper case and, if necessary,truncated at 255 characters. An exit point is provided for cases when file namesreside in paths that are greater than 255 characters. The installation can use theexit to provide a meaningful name.eTrust CA-Top Secret resource authorization processing considers the periodcharacter as a delimiter. This delimiter is used when permitting maskedresources, such as, when providing security for data sets. Path names, however,use the slash character as a delimiter. Before a file is validated, the path namewill have all slash characters, with the exception of the first, translated into aperiod delimiter. Other special characters is translated into the dollar sign ($).These include characters that are used as masking characters in resourcepermissions. If not translated, these characters could create undesired results.The special characters include the period, asterisk, dash, plus, blank, and quote.An exit point is provided which can further modify any character to meet specialneeds, with the exception of the slash character which will always be translatedto a period delimiter.Some examples of path name translation follow:Original pathnameTranslated path nameSample resourceauthorizationsSecurityaction/bin/su /BIN.SU TSS PER(USER01) HFSSEC(/BIN.SU)ACCESS(NONE)/u/user01/proj1/file1.txt/U.USER01.PROJ1.FILE1$TXTTSS PERMIT(USER01)HFSSEC(/U.%.PROJ1.FILE1$TXT)ACCESS(ALL)/usr/sbin/mknod /USR.SBIN.MKNOD TSS PER(SYSPROG)HFSSEC(/USR.SBIN.MKNOD)ACCESS(ALL)No access toswitch usercommandAll accessallowedAllow systemprogrammersto createspecialcharacters.Controlling Access to the Hierarchical File System 2–5