🚀 go-pugleaf

On Mon, 5 Sep 2005 11:22:18 -0700 Paul V DAngelo <essteam@juno.com> wrote:

:>Some products do not allow Authorized Libraries or Functions.
:>One that comes to mind is MQSeries on Z/os, MQ Does not allow Security
:>Exits in
:>a Channel Initizator to be Authorized.
:>Having stated that, It was not disclosed to me what products or services
:>they are talking about.
:>I just happne to know About MQ.

:>If the product does not allow An apf Authoried service to be used the
:>installation
:>needs to build there own environment, hence an Authorizing SVC.

:>Customer may not be able to authorized there routines  because the
:>product exits be
:>be in a Non Authorized State and the exit programs may loaded from a non
:>authorized library.

Then you use encapsulation.

You code up the function that requires authorization and invoke it via PC or
SVC.

:>On Mon, 5 Sep 2005 18:06:12 +0300 Binyamin Dissen
:><bdissen@dissensoftware.com> writes:
:>> On Mon, 5 Sep 2005 10:46:21 -0700 Paul V DAngelo <essteam@juno.com>
:>> wrote:
:>>
:>> :>I have a client who would like me to develop a presentation on an
:>> :>Authorizing Address Space.
:>> :>I suggested simply writting an SVC that switches Authorizations
:>> instead
:>> :>of and address space.
:>> :>That Suggestion was fround upon.
:>> :>They are building this facility to alow   Vendor Products and As
:>> well As
:>> :>IBM products
:>> :>to issues Authorized Services where I the Vendor does not
:>> usually/easily
:>> :>permit it.
:>>
:>> Such as?
:>>
:>> :>The customer would like to develop a cross memory environment;
:>> :>issue  a Program Call Instruction form a vendor product address
:>> space to
:>> :>thecustomers
:>> :>Authorizing  Server Address Space and allow the caller to be in
:>> :>Supervisor State key xx or APF Authorized.
:>>
:>> Why can't they simply APF authorize those programs that require it?
:>>
:>> :>I believe an SVC could be developed to accomplished this, but I
:>> suspect
:>> :>theres more to this that
:>> :>what they are telling  me.
:>>
:>> Could be done as a PC as well.
:>>
:>> But......
:>>
:>> :>My first question  is when the Cross Memory Program is executed,
:>> it would
:>> :>Sets the  APF Authorization bit
:>> :>and return.  WHo IS in the APF state, The entire Calling Address
:>> Space or
:>> :>only  the invoking TCB ?
:>>
:>> APF applies to a job step task.
:>>
:>> But........
:>>
:>> :>Can anyone on the list speak to the pros vs cons of developing an
:>> :>Authorizing SVC
:>> :>against an Authorizing Address Space.
:>>
:>> It is usually very wrong to set APF from an uncontrolled environment
:>> (not
:>> loaded from APF authorized libraries).
:>>
:>> The service should be encapsulated.
:>>
:>> :>I also suspect that Some Security Checking would be done in this
:>> Address
:>> :>Space,
:>> :>since that was the first concept they had me explore.
:>>
:>> How will they verify an uncontrolled environment?

--
Binyamin Dissen <bdissen@dissensoftware.com>
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.