z/VM: CP Commands and Utilities Reference - z/VM - IBM

Usage Notes
VMAC
gives the external security manager (ESM) the power to dynamically turn
mandatory access control (MAC) on or off. If you specify MAC and VMAC for
this command, you are enabling MAC and allowing the external security
manager (ESM) to dynamically disable MAC. If you specify VMAC and you do
not specify MAC for this command, you are disabling MAC and allowing the
ESM to dynamically enable MAC.
VPROT
gives the external security manager (ESM) the power to dynamically turn
command access protection on or off. If you specify PROT and VPROT for this
command, you are enabling protection and allowing the external security
manager (ESM) to dynamically disable that protection. If you specify VPROT
and you do not specify PROT for this command, you are disabling protection
and allowing the ESM to dynamically enable that protection.
1. For each existing CP command, CP has at least 1 command table entry block.
If the command has more than 1 privilege class, CP has 1 command table
entry block for each version of the command. The only exceptions to this are
the QUERY and SET commands. CP has at least 1 command table entry
block for each QUERY and SET subcommand.
2. When you define a new CP command or a new version of an existing CP
command, you must supply CP with certain information about that command.
The amount of information you must supply varies depending on what you are
defining. You must always supply the command (or subcommand) information
and the following table lists any other operands you are required to supply
when defining a new command or a new command version.
When Adding a New: You Must Specify:
Command EPNAME EPNAME
PRIVCLASSANY - or - PRIVCLASSES
IBMCLASS
Command Version PRIVCLASSANY - or - PRIVCLASSES
IBMCLASS
DEFINE COMMAND / CMD
3. To load the command processing code into CP’s system execution space, use
the CPXLOAD command (page 101).
4. If you do not specify the ENABLE operand, the new CP command is initially in
a disabled state. This means that the command and any alias that is defined
for this command will not function. To activate a CP command after defining it,
use the ENABLE COMMAND or CMD command (page 426). This means that
the command you defined will now function, as will any alias you have defined
and explicitly enabled for that command.
5. To display the real address of the CP command table entry block, the current
IBM class, and the current privilege class for a specified CP command, use the
LOCATE CMDBK command (page 528).
6. To change the definition of an existing CP command, use the MODIFY
COMMAND or CMD command (page 599).
7. To deactivate a CP command after defining it, use the DISABLE COMMAND
or CMD command (page 263). If you disable a base command, any alias that
is defined for that command will not function.
8. To obtain information such as the enable/disable status for the command you
have defined, use the QUERY CPCMDS command (page 728).
Chapter 2. CP Commands 137