🚀 go-pugleaf

In ISPF 3.4, trying to browse a dataset to which you do not have read access results in a SAF message that you don't have access, a log of the attempted access, and maybe an annoying but functionally useless "abend" message (913-xx), but you are not kicked out of TSO or ISPF as a result.  You just hit the enter key to get rid of the messages and then continue your work.  Why can't a callable tool provide the same functionality (preferably without the useless abend)?  Log the attempt, issue the SAF messages and set a return code that says "You're not allowed read access to that dataset" and just keep going.

Security features should not prevent *attempts* to access, just prevent any actual *access*, report any attempts and move on.  It's up to the human security team to notice any large-scale attempts to access secured files and question the user and/or their manager(s).

Peter


-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
Sent: Friday, February 22, 2013 3:32 AM
To: TSO-REXX@vm.marist.edu
Subject: Re: sysdsn - dataset protected

On Thu, 21 Feb 2013 18:16:10 -0500 "Farley, Peter x23353"
<Peter.Farley@BROADRIDGE.COM> wrote:

:>Sorry Binyamin, that is a red herring that I've heard far too many times.

:>All that a user who can logon to TSO/ISPF needs to "fish for datasets that he may have access to" is ISPF 3.4 and Browse.  Why is it wrong to have a callable tool to do the same thing that can be done manually?  That just makes no sense at all.

How does he do it in 3.4?

All he can do is attempt the access, and check the result - which will result
in a logging if there is a security failure.

:>-----Original Message-----
:>From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
:>Sent: Thursday, February 21, 2013 12:28 PM
:>To: TSO-REXX@vm.marist.edu
:>Subject: Re: sysdsn - dataset protected
:>
:>On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
:><andreas.fischer@GENERALI.AT> wrote:
:>
:>:>i'm using the SYSDSN function to determine if a given dsname is ok - and i
:>:>thought i will also find out when the user doesn't have read access to
:>:>this dataset. well now i found that this goes only for a dsname including
:>:>the member name, but not the dsname itself.
:>
:>:>i checked LISTDSI, but it also doesn't tell me if a user lacks of
:>:>authority. is there any built-in REXX function that will tell me if the
:>:>user has proper access authority to a dataset?
:>
:>In general such a function violates security, as it allows the end-user to
:>safely fish for datasets that he may have access to.

--

This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX