<snip> worked on projects where we had a TCB in Supervisor state and turned off the JSCBAUTH bit to avoid this <e-snip> and in so doing almost certainly introduced a system integrity exposure if you ever turned JSCBAUTH back on.
<snip> Not all libraries in the link list are necessarily authorized, depending on the setting of LNKAUTH in IEASYSxx. In that case, when running with LNKAUTH=APFTAB and you load a routine from a non-authorized library in the linklist you lose authorization, and it will never be turned back on for the duration of the step. <e-snip> Not true. The overall picture is simple: The intent is that a job's JSCBAUTH is to be determined at EXEC PGM=xxx time, based on the AC=1 attribute coupled with whether the module is fetched from an APF-authorized concatenation. Once JSCBAUTH is on, it stays on. And, in general, when JSCBAUTH is on, you may fetch only from an APF-authorized concatenation. IBM asserts nothing, as Shmuel said, other than that modules that it provides in APF-authorized libraries are suitable for invocation in an APF-authorized environment (and do not introduce system integrity exposures if they are invoked in that environment, or will take an APAR if they do) and that it is your responsibility to manage what you put into APF-authorized libraries to that same level of responsibility. Peter Relson z/OS Core Technology Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
