🚀 go-pugleaf

Some products do not allow Authorized Libraries or Functions.
One that comes to mind is MQSeries on Z/os, MQ Does not allow Security
Exits in
a Channel Initizator to be Authorized.
Having stated that, It was not disclosed to me what products or services
they are talking about.
I just happne to know About MQ.

If the product does not allow An apf Authoried service to be used the
installation
needs to build there own environment, hence an Authorizing SVC.

Customer may not be able to authorized there routines  because the
product exits be
be in a Non Authorized State and the exit programs may loaded from a non
authorized library.

-pd-
========================================================================


On Mon, 5 Sep 2005 18:06:12 +0300 Binyamin Dissen
<bdissen@dissensoftware.com> writes:
> On Mon, 5 Sep 2005 10:46:21 -0700 Paul V DAngelo <essteam@juno.com>
> wrote:
>
> :>I have a client who would like me to develop a presentation on an
> :>Authorizing Address Space.
> :>I suggested simply writting an SVC that switches Authorizations
> instead
> :>of and address space.
> :>That Suggestion was fround upon.
> :>They are building this facility to alow   Vendor Products and As
> well As
> :>IBM products
> :>to issues Authorized Services where I the Vendor does not
> usually/easily
> :>permit it.
>
> Such as?
>
> :>The customer would like to develop a cross memory environment;
> :>issue  a Program Call Instruction form a vendor product address
> space to
> :>thecustomers
> :>Authorizing  Server Address Space and allow the caller to be in
> :>Supervisor State key xx or APF Authorized.
>
> Why can't they simply APF authorize those programs that require it?
>
> :>I believe an SVC could be developed to accomplished this, but I
> suspect
> :>theres more to this that
> :>what they are telling  me.
>
> Could be done as a PC as well.
>
> But......
>
> :>My first question  is when the Cross Memory Program is executed,
> it would
> :>Sets the  APF Authorization bit
> :>and return.  WHo IS in the APF state, The entire Calling Address
> Space or
> :>only  the invoking TCB ?
>
> APF applies to a job step task.
>
> But........
>
> :>Can anyone on the list speak to the pros vs cons of developing an
> :>Authorizing SVC
> :>against an Authorizing Address Space.
>
> It is usually very wrong to set APF from an uncontrolled environment
> (not
> loaded from APF authorized libraries).
>
> The service should be encapsulated.
>
> :>I also suspect that Some Security Checking would be done in this
> Address
> :>Space,
> :>since that was the first concept they had me explore.
>
> How will they verify an uncontrolled environment?
>
> --
> Binyamin Dissen <bdissen@dissensoftware.com>
> http://www.dissensoftware.com
>
> Director, Dissen Software, Bar & Grill - Israel
>
>
> Should you use the mailblocks package and expect a response from me,
> you should preauthorize the dissensoftware.com domain.
>
> I very rarely bother responding to challenge/response systems,
> especially those from irresponsible companies.
>