🚀 go-pugleaf

> I suggested simply writting an SVC that switches Authorizations
instead
> of and address space. That Suggestion was fround upon.

And rightly so. It's a profoundly stupid idea.

> They are building this facility to alow Vendor Products and As well As
> IBM products to issues Authorized Services where I the Vendor does not
> usually/easily permit it.

Huh? Just a WAG, but I don't think the "customer" understands much about
z/OS internals.

> The customer would like to develop a cross memory environment;
> issue  a Program Call Instruction form a vendor product address space
to
> thecustomers
> Authorizing  Server Address Space and allow the caller to be in
> Supervisor State key xx or APF Authorized.

This does not compute. How was anyone going to issue a PC from the
vendor's address space? If the vendor's code doesn't do it who -IS-
going to? And if you've got the 'nads to plant your hooks inside the
vendor's code, then you're already as authorized as you ever needed to
be... so this "function" would be superfluous.

> I believe an SVC could be developed to accomplished this, but I
suspect
> theres more to this that what they are telling  me.

Yup.

> My first question  is when the Cross Memory Program is executed, it
would
> Sets the  APF Authorization bit and return

Don't even think about it!!!! This is a violation of MVS integrity
rules. There is no way to secure the "function" you would be providing.
Ask your customer if it was their intention to wipe out all of their
security rules. I'm going out on a limb and guessing that's not what
they had in mind.

> WHo IS in the APF state, The entire Calling Address Space or only  the
> invoking TCB ?

If you don't know that, you shouldn't be contemplating it either. For
the record, turning on the JSCBAUTH bit causes the entire job step to
become APF authorized, i.e. the job step task and all of its subtasks
(and theirs, and theirs etc.) In other words, its an all or nothing
deal.

> Can anyone on the list speak to the pros vs cons of
> developing an Authorizing SVC against an Authorizing Address Space.

Sure many of us can. DON'T DO IT!

> I also suspect that Some Security Checking would be done in this
Address
> Space, since that was the first concept they had me explore.

Forget it. It has been studied endlessly. It's not a soluble problem.

CC