Thanks Peter Relson! I just noticed that on my CPAC.PARMLIB(IKJTSO00) GIMSMP is already on AUTHPGM, so I guess that one is safe, but I understand now that adding IBM programs there should not be done unless directed from IBM.
Regards, Leo -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Peter Relson Sent: Tuesday, November 19, 2019 9:06 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: AUTHPGM in IKJTSOxx <snip> I share the curiosity about why TSO gets quarantined like a contagious pit-bull. If I can run PGM=ABC in a batch job with no more authorization that SAF READ to the load library, then why are there extra hurdles to run the exact same program under TSO? I don't mean technically why; I mean architecturally why. </snip> There aren't any such hurdles that come to mind. Your example is not one of authorization but rather of permission. It is authorized programs that are "quarantined". Remember, they are running in the same state and key as the unauthorized program that invoked it and that unauthorized program could, were it not for the system non-dispatchability protection, adversely affect the running of the authorized program. Running as an AUTHPGM is what tells the system to provide that protection. <snip> Would you help clarify if doing something like Gil asked for, adding an IBM program like GIMSMP to AUTHPGM would be safe, warrant a question to IBM to IBM or definitely unsafe? </snip> It is not safe unless the program owner says that it is safe. Do not assume. The same can be said to be true of putting things in LPA that were not designed to be there (especially if they were designed to be run from a steplib and not from the LNKLST where LNKAUTH=LNKLST might be in effect).. Peter Relson z/OS Core Technology Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
