eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Securing HFS FunctionsKeywordALLCONTROLDescriptionAllows all of the above.A special access not used for normal file accessvalidation. This is used with HFS function security toallow a user to change file attributes. Moreinformation can be found in the following section.ReportingAudit records created by HFS file access checks, (i.e., violations, and auditevents) are written to the Audit Tracking File and accessed by the TSSUTILreport utility. TSSUTIL integrates these events among other events according tothe report generation criteria.Securing HFS FunctionsIn addition to file access security, HFS functions can also be secured. Thesefunctions can be a system action, such as setting a ptrace or a job’s priority, orthey can be file-related, such as changing the file mode or audit settings.A system function is secured by a rule in the IBMFAC class, while a file-relatedfunction is secured by a combination of an IBMFAC class rule and a HFS fileresource rule. By following this approach, changes to file attributes can bepermitted at a global basis, or restricted to a particular file.The resource name format for HFS IBMFAC rules is: BPX.CAHFS.function. Anexample of a permission would be:TSS PER(USER01) IBMFAC(BPX.CAHFS.function) ACCESS(READ)System FunctionsIn order to perform a system function, the user requires READ access to thecorresponding IBMFAC.Controlling Access to the Hierarchical File System 2–7