General resource profile
A RACF profile that protects something other than a dataset, such as a CICS transaction, a program or an operator command.
Also written RACF class, resource class, FACILITY class, RDEFINE, SETROPTS RACLIST
RACF protects much more than datasets. Anything a subsystem wants to control can be protected: CICS transactions, programs, operator commands, started tasks, JES output and many system functions. These are protected with general resource profiles.
Resources are sorted into classes, and each class covers one kind of resource. FACILITY is a general class used by many z/OS functions. TCICSTRN holds CICS transactions. OPERCMDS covers operator commands. PROGRAM covers programs. The class must be active for its profiles to have any effect.
You create a profile with RDEFINE, giving the class and the resource name, and grant access with PERMIT, adding the CLASS operand. As with dataset profiles, a profile can be generic, so one profile covers many names.
Many classes are kept in memory for speed. After a change, the in-memory copy has to be refreshed, usually with SETROPTS RACLIST(classname) REFRESH, before the change takes effect. Forgetting that step is the most common reason a new permission "does not work".
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- Dataset profileA security rule describing which datasets it covers and who is allowed to do what to them.
- PERMITThe command that grants or removes a user or group's access to a protected resource.
- Access levelHow much a user may do to a resource: read it, change it, or control it, with each level including the ones below.
- SAFThe interface z/OS and its subsystems use to ask the security manager whether something is allowed.
- CICS transactionOne unit of online work in CICS: the whole exchange of receiving a request, doing the work, and sending a response.