ADDSD
Creates a rule that protects datasets by name.
Also written AD
Why it matters. A dataset with no rule is open to anyone RACF lets in. ADDSD closes the door first.
Syntax
{ADDSD | AD} 'profile-name' [UACC(access)] [OWNER(userid | group)] [GENERIC] [AUDIT(...)] [WARNING] [FROM('profile')]- 'profile-name'
- The rule's name. Its first part must be a user ID or group. * and ** make it generic.
- UACC(access)
- What everyone gets who is not on the access list. If you leave it out, RACF uses your connect group's default.
- OWNER(id)
- Who owns the profile. If you leave it out, you do.
- GENERIC
- Treat the name as generic even if it has no * or %.
- AUDIT(...)
- Which access attempts to log, such as AUDIT(FAILURES(READ)).
- WARNING
- Allow access with a warning instead of refusing. Used to test a new rule.
- FROM('profile')
- Copy the settings of an existing profile.
Try it ADDSD
- 1
Protect every dataset that starts with ZBANK.DEV. Let nobody in by default.
ADDSD 'ZBANK.DEV.**' UACC(NONE) - 2
Check the rule. Show it, with its access list.
LISTDSD DA('ZBANK.DEV.**') AUTHUSER - 3
Try to protect names that start with ZBFAKE.
ADDSD 'ZBFAKE.DEV.**' UACC(NONE)
Remember
- Quote the profile name. ** matches many datasets.
- UACC(NONE) means closed to everyone not on the list.
- ADDSD makes the rule. PERMIT says who may use it.
The usual mistake
ADDSD 'ZBANK.DEV.**' ID(ZBDEV) ACCESS(UPDATE)
ADDSD has no ID or ACCESS. Those belong to PERMIT, so ADDSD refuses the command.
ADDSD 'ZBANK.DEV.**' UACC(NONE), then PERMIT
On real z/OS
MF/OS models the name, UACC, OWNER, AUDIT and FROM, and says so when it ignores an operand (WARNING, for example). It also applies a new generic profile at once. On a real system a generic profile takes effect only after SETROPTS GENERIC(DATASET) REFRESH, a LISTDSD with GENERIC for a covered dataset, or the next sign-on, and ** in a dataset profile needs enhanced generic naming to be on.
Where can I practise ADDSD?
Right here, at ZedBank. You take a junior job at a simulated bank and use ADDSD in real work, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- Dataset profileA security rule describing which datasets it covers and who is allowed to do what to them.
- Access levelHow much a user may do to a resource: read it, change it, or control it, with each level including the ones below.
- High-level qualifierThe first part of a dataset name, which usually identifies the owner and drives how security and storage rules apply.
- DatasetWhat a mainframe calls a file: a named collection of records with a defined structure, rather than a loose stream of bytes.