z/VM: CP Commands and Utilities Reference - z/VM - IBM

DEFINE DIAGNOSE
DIAGNOSE code that you are defining. The variable name must be a 1- to
8-character string. The first character must be alphabetic or one of the following
special characters: dollar sign ($), number sign (#), underscore (_), or at sign
(@). The rest of the string can be alphanumeric characters, the 4 special
characters ($, #, _, and @), or any combination thereof.
INVAR
tells CP not to process this DIAGNOSE code if the virtual machine issuing the
DIAGNOSE code is in host access register mode.
INVXC
tells CP not to process this DIAGNOSE code if the virtual machine issuing the
DIAGNOSE code is in Enterprise System Architecture/Extended Configuration
(ESA/XC) mode.
MAC
tells CP to enable mandatory access control (MAC) for the DIAGNOSE code
that you are defining. When MAC is enabled for your DIAGNOSE code, the
external security manager (ESM) compares the security label of the virtual
machine that issued your DIAGNOSE code to the security label of the resource
or user that your DIAGNOSE code will affect. If you want the ESM to
dynamically turn MAC on or off for this DIAGNOSE code, specify the VMAC
operand.
PRIVCLASSANY
tells CP that users with any privilege class can issue the DIAGNOSE code that
you are defining.
PRIVclasses classes
tells CP that only users with 1 or more of the specified privilege classes can
issue the DIAGNOSE code that you are defining. The variable classes is 1 or
more privilege classes in the range A through Z, 1 through 6, or an asterisk (*).
Privilege class * indicates all privilege classes (A-Z and 1-6).
Note: If you want more than one privilege class, specify your classes in one
string of characters. Do not separate the classes with blank spaces. For
example, specify “privclasses abc123”, not “privclasses a b c 1 2 3”.
PROC
tells CP that, after performing the initial privilege class checks, your DIAGNOSE
code processor will be responsible for any further calls to the external security
manager (ESM) for the DIAGNOSE code that you are defining.
PROT
tells the external security manager (ESM) to protect the DIAGNOSE code that
you are defining. When protection is enabled for your DIAGNOSE code, the
ESM checks an access list to ensure that the user who issued your DIAGNOSE
code is authorized to do so. If you want the ESM to dynamically turn protection
on or off for your DIAGNOSE code, specify the VPROT operand.
VMAC
gives the external security manager (ESM) the power to dynamically turn
mandatory access control (MAC) on or off.
VPROT
gives the external security manager (ESM) the power to dynamically turn
DIAGNOSE code access protection on or off. If you specify PROT and VPROT
for this command, you are enabling protection and allowing the external security
manager (ESM) to dynamically disable that protection. If you specify VPROT
Chapter 2. CP Commands 161