APF authorisation
The Authorized Program Facility: the z/OS rule that only programs from approved libraries may use the system's most powerful functions.
Also written APF, Authorized Program Facility, APF list, APF-authorised library, AC(1)
APF, the Authorized Program Facility, controls which programs may run with special authority on z/OS. An authorised program can use system functions that ordinary programs cannot, including functions that can switch off normal protection.
Two things are needed. The program must be stored in a library on the APF list, which the site sets in PARMLIB and can change with a system command. And the program must be marked as authorised when it is link-edited, with the attribute AC(1).
Because an authorised program can do almost anything, APF libraries are among the most sensitive datasets on a system. Anyone who can add a program to one could take control of the system. Security teams protect them closely with RACF, keep the APF list short, and auditors check both every year.
Application developers rarely need APF. If a request to make a program authorised reaches you, it will go through security review and change control first, which is the right outcome.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- PARMLIBThe library of members that holds z/OS's own settings, read when the system starts and on some commands.
- Load moduleThe runnable form of a program, stored in a library, which JCL executes by name.
- Link-editCombining compiled object code with the other modules it needs into a single runnable program.
- System programmerThe person who installs, configures, tunes and upgrades the operating system and its subsystems.
- SAFThe interface z/OS and its subsystems use to ask the security manager whether something is allowed.