[prev in list] [next in list] [prev in thread] [next in thread] 

List:       racf-l
Subject:    Re: RACF, TWS & JCL
From:       D E Engelbrecht <elardus.engelbrecht () SITA ! CO ! ZA>
Date:       2009-11-23 14:11:12
Message-ID: 200911231411.nANBlnar011011 () mailgw ! cc ! uga ! edu
[Download RAW message or body]

Walt Farrell wrote:

Mark Wilson wrote:
>> I have an issue with a customer where they want to restrict the TWS
Userid from using SYSIN DD * in JCL.

Do you want to restrict SYSIN during submit or during viewing in SDSF for
example?

Walter Farrell wrote:

>Other than with exits, I don't think you can do that.
>Otherwise, you might have to check for a READ for a JESSPOOL resource,
which for that user would (I think) be just SYSIN, but I'm not certain.

I did some testing in a sandbox (my favourite of course) where there is
only one profile in JESSPOOL class, &RACLNDE.**. I gave myself NONE for
that, but seemed an id can't be limited to its own job's resources. Thus
when submitter = job owner, ALTER is assumed. This includes SYSIN.

It seemed an exit is the way. Perhaps IEFUJV (Job Validation Exit)?

Groete / Greetings
Elardus Engelbrecht
[prev in list] [next in list] [prev in thread] [next in thread]