Granulated Privileges

Capabilities associated with privileged status can be individually recognized as granulated privileges. When it is undesirable or even dangerous for a process to acquire the full privileged status, granulated privileges can be alternatively used. Given a particular granulated privilege, a process is bounded by the limitation of such privilege. A security administrator can identify the security needs of a user or a program and delegate just the capabilities necessary for the performance of the job (the concept of least privilege). The description for each granulated privilege follows.

Privilege

Description

CHANGE

A process with this privilege can change titles of other users’ disk files. This includes the file ownership. When a new file name is identical to another user’s existing disk file, the file overwrite is not permitted if it is not accompanied by the REMOVE privilege.

CHANGESEC

A process with this privilege can modify security file attributes for files belonging to other users.

CREATEFILE

A process with this privilege can create disk files under another usercode without replacing existing disk files. The privilege does not include file creations through the WFL CHANGE command or through a library maintenance copy operation.

EXECUTE

A process with this privilege can execute code files of other users.

GETSTATUS

A process with this privilege can use the GETSTATUS intrinsic to retrieve information about jobs, tasks, status of peripherals, status of the operating system, and mainframe configuration. The privilege does not include those GETSTATUS directory and volume requests that currently require privileged-user status.

GSDIRECTORY

A process with this privilege can browse other users’ private directories and files. In addition, this privilege enables a program to make GETSTATUS directory and volume requests that are typically restricted to a privileged-user status and enables a user to use the FILEDATA TAPEDIR request.

IDC

A process with this privilege can update the current DATACOMINFO file through DATACOMSUPPORT entry points, which are used by the SYSTEM/IDC utility.

LOCALCOPY

A process with this privilege can copy files and directories belonging to other users. This is done on the local host using library maintenance.

LOGINSTALL

A process with this privilege can access the MCSLOGGER intrinsic to create log installation records.

LOGOTHERS

A process with this privilege can access the MCSLOGGER intrinsic to create other log records for which privilege is currently required.

PLATFORMACCESS

A process with this privilege can use the ClearPath Extension Kit for MCP to build and execute image files.

PLATFORMADMIN

A process with this privilege can use the ClearPath Extension Kit for MCP to have administrative access to the firmware environment.

READ

A process with this privilege can have read access to other users’ files, regardless of their security attributes.

REMOVE

A process with this privilege can remove files belonging to other users. When REMOVE is used with the CREATEFILE, LOCALCOPY, or CHANGE privileges, an existing disk file can be either replaced or removed. A close with purge operation on a non-owned file also requires the process to have the REMOVE privilege.

SETSTATUS

A process with this privilege can use the SETSTATUS intrinsic to control MCP mix, unit, and operational functions. The privilege does not include those SETSTATUS directory and volume requests that currently require privileged-user status.

SYSTEMUSER

A process with this privilege can make GETSTATUS, SETSTATUS, and DCKEYIN requests that are currently restricted to a system user.

UNWRAPRESTRICT

A process with this privilege can use MCP_FILEWRAPPER and MCP_WRAPPER to unwrap wrapped files and containers without hazardous files being marked as restricted.

USERDATA

A process with this privilege can access the USERDATA intrinsic. This includes all USERDATA functionality available to

  • A privileged user on a system with security administrator status disabled.

  • A security administrator on a system with security administrator status enabled.

WRITE

A process with this privilege can have write access to other users’ files, regardless of the file’s security attributes. Processes with this privilege can also change all modifiable, non-security-related file attributes.

An operator assigns granulated privileges to a usercode by running the MAKEUSER utility or assigns granulated privileges to an object codefile by using the MP (Mark Program) system command. For more information about the MAKEUSER utility, refer to the System Software Utilities Operations Reference Manual. For more information about the MP command, refer to the System Commands Reference.

Prev  Up  Next
Privileged Status  Home  Nonusercoded Status