🚀 go-pugleaf

Either TSO command LISTDSD:

x = Outtrap('O.')                          
"LISTDSD DATASET('SYS1.PARMLIB')"          
Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB 

Or why not use a membername anyway ?  It's no need for the member to exist (to get a 'PROTECTED DATASET' reply).
 


Regards
Thomas Berg
____________________________________________________________________
Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)



                                 

> -----Ursprungligt meddelande-----
> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> Andreas Fischer
> Skickat: den 21 februari 2013 16:55
> Till: TSO-REXX@VM.MARIST.EDU
> �mne: [TSO-REXX] sysdsn - dataset protected
> 
> hi,
> 
> i'm using the SYSDSN function to determine if a given dsname is ok -
> and i thought i will also find out when the user doesn't have read
> access to this dataset. well now i found that this goes only for a
> dsname including the member name, but not the dsname itself.
> 
> i checked LISTDSI, but it also doesn't tell me if a user lacks of
> authority. is there any built-in REXX function that will tell me if the
> user has proper access authority to a dataset?
> 
> 
> regards,
> andi
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions, send
> email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

well for listdsd, to be sure that you get the desired result you have two 
issue the command twice, first without and then with the generic 
parameter. this is some kind of overhead that i want to avoid just for 
finding out if access to a data set is possible.

that was the reason i used SYSDSN, and it worked and works fine with 
dsname and member name. i just didn't realize it works different without 
member names as it's the case when i test the dsname of a sequential data 
set.

regards,
andi


TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 21.02.2013 
17:24:19:

> Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> An: TSO-REXX@VM.MARIST.EDU, 
> Datum: 21.02.2013 17:25
> Betreff: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
> Gesendet von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
> 
> Either TSO command LISTDSD:
> 
> x = Outtrap('O.') 
> "LISTDSD DATASET('SYS1.PARMLIB')" 
> Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB 
> 
> Or why not use a membername anyway ?  It's no need for the member to
> exist (to get a 'PROTECTED DATASET' reply).
> 
> 
> 
> Regards
> Thomas Berg
> ________________________
_________________________
___________________
> Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> 
> 
> 
> 
> 
> > -----Ursprungligt meddelande-----
> > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> > Andreas Fischer
> > Skickat: den 21 februari 2013 16:55
> > Till: TSO-REXX@VM.MARIST.EDU
> > �mne: [TSO-REXX] sysdsn - dataset protected
> > 
> > hi,
> > 
> > i'm using the SYSDSN function to determine if a given dsname is ok -
> > and i thought i will also find out when the user doesn't have read
> > access to this dataset. well now i found that this goes only for a
> > dsname including the member name, but not the dsname itself.
> > 
> > i checked LISTDSI, but it also doesn't tell me if a user lacks of
> > authority. is there any built-in REXX function that will tell me if 
the
> > user has proper access authority to a dataset?
> > 
> > 
> > regards,
> > andi
> > 
> > ----------------------------------------------------------------------
> > For TSO-REXX subscribe / signoff / archive access instructions, send
> > email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions,
> send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

SYSDSN works with membername for sequential ds also (= 'PROTECTED DATASET').



Regards
Thomas Berg
____________________________________________________________________
Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)




> -----Ursprungligt meddelande-----
> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> Andreas Fischer
> Skickat: den 21 februari 2013 17:38
> Till: TSO-REXX@VM.MARIST.EDU
> �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset
> protected
> 
> well for listdsd, to be sure that you get the desired result you have
> two issue the command twice, first without and then with the generic
> parameter. this is some kind of overhead that i want to avoid just for
> finding out if access to a data set is possible.
> 
> that was the reason i used SYSDSN, and it worked and works fine with
> dsname and member name. i just didn't realize it works different
> without member names as it's the case when i test the dsname of a
> sequential data set.
> 
> regards,
> andi
> 
> 
> TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 21.02.2013
> 17:24:19:
> 
> > Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> > An: TSO-REXX@VM.MARIST.EDU,
> > Datum: 21.02.2013 17:25
> > Betreff: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
> Gesendet
> > von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
> >
> > Either TSO command LISTDSD:
> >
> > x = Outtrap('O.')
> > "LISTDSD DATASET('SYS1.PARMLIB')"
> > Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB
> >
> > Or why not use a membername anyway ?  It's no need for the member to
> > exist (to get a 'PROTECTED DATASET' reply).
> >
> >
> >
> > Regards
> > Thomas Berg
> > ________________________
> _________________________
> ___________________
> > Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> >
> >
> >
> >
> >
> > > -----Ursprungligt meddelande-----
> > > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> > > Andreas Fischer
> > > Skickat: den 21 februari 2013 16:55
> > > Till: TSO-REXX@VM.MARIST.EDU
> > > �mne: [TSO-REXX] sysdsn - dataset protected
> > >
> > > hi,
> > >
> > > i'm using the SYSDSN function to determine if a given dsname is ok
> -
> > > and i thought i will also find out when the user doesn't have read
> > > access to this dataset. well now i found that this goes only for a
> > > dsname including the member name, but not the dsname itself.
> > >
> > > i checked LISTDSI, but it also doesn't tell me if a user lacks of
> > > authority. is there any built-in REXX function that will tell me if
> the
> > > user has proper access authority to a dataset?
> > >
> > >
> > > regards,
> > > andi
> > >
> > > -------------------------------------------------------------------
> -
> > > -- For TSO-REXX subscribe / signoff / archive access instructions,
> > > send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-
> REXX
> >
> > ---------------------------------------------------------------------
> -
> > For TSO-REXX subscribe / signoff / archive access instructions, send
> > email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions, send
> email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

oh it does? i have to try out...

tack s� mycket!


TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 21.02.2013 
17:47:25:

> Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> An: TSO-REXX@VM.MARIST.EDU, 
> Datum: 21.02.2013 17:49
> Betreff: [TSO-REXX] SV: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-
> REXX] sysdsn - dataset protected
> Gesendet von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
> 
> SYSDSN works with membername for sequential ds also (= 'PROTECTED 
DATASET').
> 
> 
> 
> Regards
> Thomas Berg
> ________________________
_________________________
___________________
> Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> 
> 
> 
> 
> > -----Ursprungligt meddelande-----
> > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> > Andreas Fischer
> > Skickat: den 21 februari 2013 17:38
> > Till: TSO-REXX@VM.MARIST.EDU
> > �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset
> > protected
> > 
> > well for listdsd, to be sure that you get the desired result you have
> > two issue the command twice, first without and then with the generic
> > parameter. this is some kind of overhead that i want to avoid just for
> > finding out if access to a data set is possible.
> > 
> > that was the reason i used SYSDSN, and it worked and works fine with
> > dsname and member name. i just didn't realize it works different
> > without member names as it's the case when i test the dsname of a
> > sequential data set.
> > 
> > regards,
> > andi
> > 
> > 
> > TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 
21.02.2013
> > 17:24:19:
> > 
> > > Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> > > An: TSO-REXX@VM.MARIST.EDU,
> > > Datum: 21.02.2013 17:25
> > > Betreff: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
> > Gesendet
> > > von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
> > >
> > > Either TSO command LISTDSD:
> > >
> > > x = Outtrap('O.')
> > > "LISTDSD DATASET('SYS1.PARMLIB')"
> > > Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB
> > >
> > > Or why not use a membername anyway ?  It's no need for the member to
> > > exist (to get a 'PROTECTED DATASET' reply).
> > >
> > >
> > >
> > > Regards
> > > Thomas Berg
> > > _______________________
_
> > _________________________
> > ___________________
> > > Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> > >
> > >
> > >
> > >
> > >
> > > > -----Ursprungligt meddelande-----
> > > > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F
�r
> > > > Andreas Fischer
> > > > Skickat: den 21 februari 2013 16:55
> > > > Till: TSO-REXX@VM.MARIST.EDU
> > > > �mne: [TSO-REXX] sysdsn - dataset protected
> > > >
> > > > hi,
> > > >
> > > > i'm using the SYSDSN function to determine if a given dsname is ok
> > -
> > > > and i thought i will also find out when the user doesn't have read
> > > > access to this dataset. well now i found that this goes only for a
> > > > dsname including the member name, but not the dsname itself.
> > > >
> > > > i checked LISTDSI, but it also doesn't tell me if a user lacks of
> > > > authority. is there any built-in REXX function that will tell me 
if
> > the
> > > > user has proper access authority to a dataset?
> > > >
> > > >
> > > > regards,
> > > > andi
> > > >
> > > > 
-------------------------------------------------------------------
> > -
> > > > -- For TSO-REXX subscribe / signoff / archive access instructions,
> > > > send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-
> > REXX
> > >
> > > 
---------------------------------------------------------------------
> > -
> > > For TSO-REXX subscribe / signoff / archive access instructions, send
> > > email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX
> > 
> > ----------------------------------------------------------------------
> > For TSO-REXX subscribe / signoff / archive access instructions, send
> > email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions,
> send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

> -----Ursprungligt meddelande-----
> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> Andreas Fischer
> Skickat: den 21 februari 2013 17:54
> Till: TSO-REXX@VM.MARIST.EDU
> �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] Antwort: [TSO-REXX]
> SV: [TSO-REXX] sysdsn - dataset protected
> 
> oh it does? i have to try out...
> 
> tack s� mycket!

:)

> 
> 
> TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 21.02.2013
> 17:47:25:
> 
> > Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> > An: TSO-REXX@VM.MARIST.EDU,
> > Datum: 21.02.2013 17:49
> > Betreff: [TSO-REXX] SV: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-
> REXX]
> > sysdsn - dataset protected Gesendet von: TSO REXX Discussion List
> > <TSO-REXX@VM.MARIST.EDU>
> >
> > SYSDSN works with membername for sequential ds also (= 'PROTECTED
> DATASET').
> >
> >
> >
> > Regards
> > Thomas Berg
> > ________________________
> _________________________
> ___________________
> > Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> >
> >
> >
> >
> > > -----Ursprungligt meddelande-----
> > > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> > > Andreas Fischer
> > > Skickat: den 21 februari 2013 17:38
> > > Till: TSO-REXX@VM.MARIST.EDU
> > > �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] sysdsn -
> dataset
> > > protected
> > >
> > > well for listdsd, to be sure that you get the desired result you
> > > have two issue the command twice, first without and then with the
> > > generic parameter. this is some kind of overhead that i want to
> > > avoid just for finding out if access to a data set is possible.
> > >
> > > that was the reason i used SYSDSN, and it worked and works fine
> with
> > > dsname and member name. i just didn't realize it works different
> > > without member names as it's the case when i test the dsname of a
> > > sequential data set.
> > >
> > > regards,
> > > andi
> > >
> > >
> > > TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am
> 21.02.2013
> > > 17:24:19:
> > >
> > > > Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
> > > > An: TSO-REXX@VM.MARIST.EDU,
> > > > Datum: 21.02.2013 17:25
> > > > Betreff: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
> > > Gesendet
> > > > von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
> > > >
> > > > Either TSO command LISTDSD:
> > > >
> > > > x = Outtrap('O.')
> > > > "LISTDSD DATASET('SYS1.PARMLIB')"
> > > > Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB
> > > >
> > > > Or why not use a membername anyway ?  It's no need for the member
> > > > to exist (to get a 'PROTECTED DATASET' reply).
> > > >
> > > >
> > > >
> > > > Regards
> > > > Thomas Berg
> > > > _______________________
> _
> > > _________________________
> > > ___________________
> > > > Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB
> (Publ)
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > > -----Ursprungligt meddelande-----
> > > > > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU]
> F
> �r
> > > > > Andreas Fischer
> > > > > Skickat: den 21 februari 2013 16:55
> > > > > Till: TSO-REXX@VM.MARIST.EDU
> > > > > �mne: [TSO-REXX] sysdsn - dataset protected
> > > > >
> > > > > hi,
> > > > >
> > > > > i'm using the SYSDSN function to determine if a given dsname is
> > > > > ok
> > > -
> > > > > and i thought i will also find out when the user doesn't have
> > > > > read access to this dataset. well now i found that this goes
> > > > > only for a dsname including the member name, but not the dsname
> itself.
> > > > >
> > > > > i checked LISTDSI, but it also doesn't tell me if a user lacks
> > > > > of authority. is there any built-in REXX function that will
> tell
> > > > > me
> if
> > > the
> > > > > user has proper access authority to a dataset?
> > > > >
> > > > >
> > > > > regards,
> > > > > andi
> > > > >
> > > > >
> -------------------------------------------------------------------
> > > -
> > > > > -- For TSO-REXX subscribe / signoff / archive access
> > > > > instructions, send email to LISTSERV@VM.MARIST.EDU with the
> > > > > message: INFO TSO-
> > > REXX
> > > >
> > > >
> ---------------------------------------------------------------------
> > > -
> > > > For TSO-REXX subscribe / signoff / archive access instructions,
> > > > send email to LISTSERV@VM.MARIST.EDU with the message: INFO
> > > > TSO-REXX
> > >
> > > -------------------------------------------------------------------
> -
> > > -- For TSO-REXX subscribe / signoff / archive access instructions,
> > > send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-
> REXX
> >
> > ---------------------------------------------------------------------
> -
> > For TSO-REXX subscribe / signoff / archive access instructions, send
> > email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions, send
> email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On 2/21/2013 10:01 AM, Thomas Berg wrote:
>> -----Ursprungligt meddelande-----
>> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
>> Andreas Fischer
>> Skickat: den 21 februari 2013 17:54
>> Till: TSO-REXX@VM.MARIST.EDU
>> �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] Antwort: [TSO-REXX]
>> SV: [TSO-REXX] sysdsn - dataset protected
>>
>> oh it does? i have to try out...
>>
>> tack s� mycket!

Ah, so that's how it's spelled. I grew up hearing that off
and on (my great grandmother was Swedish) but I have no
knowledge of the writing.

Tack yourself. ;-)


>
> :)
>
>>
>>
>> TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am 21.02.2013
>> 17:47:25:
>>
>>> Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
>>> An: TSO-REXX@VM.MARIST.EDU,
>>> Datum: 21.02.2013 17:49
>>> Betreff: [TSO-REXX] SV: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-
>> REXX]
>>> sysdsn - dataset protected Gesendet von: TSO REXX Discussion List
>>> <TSO-REXX@VM.MARIST.EDU>
>>>
>>> SYSDSN works with membername for sequential ds also (= 'PROTECTED
>> DATASET').
>>>
>>>
>>>
>>> Regards
>>> Thomas Berg
>>> ________________________
>> _________________________
>> ___________________
>>> Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
>>>
>>>
>>>
>>>
>>>> -----Ursprungligt meddelande-----
>>>> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
>>>> Andreas Fischer
>>>> Skickat: den 21 februari 2013 17:38
>>>> Till: TSO-REXX@VM.MARIST.EDU
>>>> �mne: [TSO-REXX] Antwort: [TSO-REXX] SV: [TSO-REXX] sysdsn -
>> dataset
>>>> protected
>>>>
>>>> well for listdsd, to be sure that you get the desired result you
>>>> have two issue the command twice, first without and then with the
>>>> generic parameter. this is some kind of overhead that i want to
>>>> avoid just for finding out if access to a data set is possible.
>>>>
>>>> that was the reason i used SYSDSN, and it worked and works fine
>> with
>>>> dsname and member name. i just didn't realize it works different
>>>> without member names as it's the case when i test the dsname of a
>>>> sequential data set.
>>>>
>>>> regards,
>>>> andi
>>>>
>>>>
>>>> TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU> schrieb am
>> 21.02.2013
>>>> 17:24:19:
>>>>
>>>>> Von: Thomas Berg <thomas.berg@SWEDBANK.SE>
>>>>> An: TSO-REXX@VM.MARIST.EDU,
>>>>> Datum: 21.02.2013 17:25
>>>>> Betreff: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
>>>> Gesendet
>>>>> von: TSO REXX Discussion List <TSO-REXX@VM.MARIST.EDU>
>>>>>
>>>>> Either TSO command LISTDSD:
>>>>>
>>>>> x = Outtrap('O.')
>>>>> "LISTDSD DATASET('SYS1.PARMLIB')"
>>>>> Say o.1  ---->   ICH35002I NOT AUTHORIZED TO LIST SYS1.PARMLIB
>>>>>
>>>>> Or why not use a membername anyway ?  It's no need for the member
>>>>> to exist (to get a 'PROTECTED DATASET' reply).
>>>>>
>>>>>
>>>>>
>>>>> Regards
>>>>> Thomas Berg
>>>>> _______________________
>> _
>>>> _________________________
>>>> ___________________
>>>>> Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB
>> (Publ)
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> -----Ursprungligt meddelande-----
>>>>>> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU]
>> F
>> �r
>>>>>> Andreas Fischer
>>>>>> Skickat: den 21 februari 2013 16:55
>>>>>> Till: TSO-REXX@VM.MARIST.EDU
>>>>>> �mne: [TSO-REXX] sysdsn - dataset protected
>>>>>>
>>>>>> hi,
>>>>>>
>>>>>> i'm using the SYSDSN function to determine if a given dsname is
>>>>>> ok
>>>> -
>>>>>> and i thought i will also find out when the user doesn't have
>>>>>> read access to this dataset. well now i found that this goes
>>>>>> only for a dsname including the member name, but not the dsname
>> itself.
>>>>>>
>>>>>> i checked LISTDSI, but it also doesn't tell me if a user lacks
>>>>>> of authority. is there any built-in REXX function that will
>> tell
>>>>>> me
>> if
>>>> the
>>>>>> user has proper access authority to a dataset?
>>>>>>
>>>>>>
>>>>>> regards,
>>>>>> andi
>>>>>>
>>>>>>


-- 

Kind regards,

-Steve Comstock
The Trainer's Friend, Inc.

303-355-2752
http://www.trainersfriend.com

* To get a good Return on your Investment, first make an investment!
   + Training your people is an excellent investment

* Try our tool for calculating your Return On Investment
     for training dollars at
   http://www.trainersfriend.com/ROI/roi.html

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

I'm not sure this will help any. But from what I understand, you want to
copy some data from a UNIX file to a member of a PDS. When it works, it is
good. But when it fails, you basically only get an RC=20. At this point,
you don't know if compressing would help or not. If you can use ISPF
services, then perhaps what you could do is use the ISPF EDIT, via ISPEXEC
EDIT, to edit the PDS member and run an "initial macro". This initial macro
could see if the member is empty or not (what to do if not empty)? It could
do an ISREDIT DELETE ALL NX command to clear the current data in the member
if that is desired. It could then use the REXX SYSCALL interface (readfile)
to read all the lines into a REXX stem variable. Which you then put into
the now empty member via a loop and ISREDIT LINE_AFTER .ZL =. After which
you can do an ISREDIT SAVE. This will give an RC=12 if the PDS directory is
full or if the PDS is out of save. RC = 0 if replace, RC=4 if added new,
RC=20 if some other error than out of directory blocks or space. Save the
RC from save in an ISPF user variable to test in the enclosing REXX
routine. Then, if the returned variable is 12, do an LMINIT, LMCOMP, LMFREE
to compress the PDS, set a "retry indicator", and try again. Of course,
test the "retry" variable before the LMINIT, LMCOMP, LMFREE, Or enclose the
entire thing in something like:

retry=1
do 2 while retry = 1
... edit pds member with initial macro
    ispexec "vget (editrc)"
    if editrc = 12 then do
      lminit
      lmcomp
      lmfree
    end
    else retry=0
end

http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/ISPZEM90/3.3.78

This is the best that I have come up with. I didn't bother with telling you
how to read the UNIX file because you already know that.

Hope that I didn't totally misunderstand what you were trying. If the RC =
20 in the above, I don't know how you'd recover. Too bad IBM did not
architect a way to retrieve a SYNAD message in the case of RC=20.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
<andreas.fischer@GENERALI.AT> wrote:

:>i'm using the SYSDSN function to determine if a given dsname is ok - and i
:>thought i will also find out when the user doesn't have read access to
:>this dataset. well now i found that this goes only for a dsname including
:>the member name, but not the dsname itself.

:>i checked LISTDSI, but it also doesn't tell me if a user lacks of
:>authority. is there any built-in REXX function that will tell me if the
:>user has proper access authority to a dataset?

In general such a function violates security, as it allows the end-user to
safely fish for datasets that he may have access to.

--
Binyamin Dissen <bdissen@dissensoftware.com>
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

> -----Ursprungligt meddelande-----
> Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> Binyamin Dissen
> Skickat: den 21 februari 2013 18:28
> Till: TSO-REXX@VM.MARIST.EDU
> �mne: Re: [TSO-REXX] sysdsn - dataset protected
> 
> On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
> <andreas.fischer@GENERALI.AT> wrote:
> 
> :>i'm using the SYSDSN function to determine if a given dsname is ok -
> and i :>thought i will also find out when the user doesn't have read
> access to :>this dataset. well now i found that this goes only for a
> dsname including :>the member name, but not the dsname itself.
> 
> :>i checked LISTDSI, but it also doesn't tell me if a user lacks of
> :>authority. is there any built-in REXX function that will tell me if
> the :>user has proper access authority to a dataset?
> 
> In general such a function violates security, as it allows the end-user
> to safely fish for datasets that he may have access to.

You have to be more specific here.  What you exactly is saying is: if RACF is stopping a user to read a dataset with a message that says that, RACF is violating the security. 
Maybe you are thinking of a function that checks it without logging in RACF ? 



Regards
Thomas Berg
____________________________________________________________________
Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

Only racf will tell you - if you have the authority that is

-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] On Behalf Of
Andreas Fischer
Sent: den 21 februari 2013 16:55
To: TSO-REXX@VM.MARIST.EDU
Subject: [TSO-REXX] sysdsn - dataset protected

hi,

i'm using the SYSDSN function to determine if a given dsname is ok - and i
thought i will also find out when the user doesn't have read access to
this dataset. well now i found that this goes only for a dsname including
the member name, but not the dsname itself.

i checked LISTDSI, but it also doesn't tell me if a user lacks of
authority. is there any built-in REXX function that will tell me if the
user has proper access authority to a dataset?


regards,
andi

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

I think if you have TOP SECRET or ACF2 they have Member Level Protection
where RACF does not.

In ACF2 or TOP SECRET you can protect the MEMBER and not necessarily have
the same level of protection for the Data Set.


So do you have a different SAF than RACF?

Lizette


> -----Original Message-----
> From: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] On Behalf
Of
> Thomas Berg
> Sent: Thursday, February 21, 2013 10:42 AM
> To: TSO-REXX@VM.MARIST.EDU
> Subject: [TSO-REXX] SV: [TSO-REXX] sysdsn - dataset protected
> 
> > -----Ursprungligt meddelande-----
> > Fr�n: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] F�r
> > Binyamin Dissen
> > Skickat: den 21 februari 2013 18:28
> > Till: TSO-REXX@VM.MARIST.EDU
> > �mne: Re: [TSO-REXX] sysdsn - dataset protected
> >
> > On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
> > <andreas.fischer@GENERALI.AT> wrote:
> >
> > :>i'm using the SYSDSN function to determine if a given dsname is ok -
> > and i :>thought i will also find out when the user doesn't have read
> > access to :>this dataset. well now i found that this goes only for a
> > dsname including :>the member name, but not the dsname itself.
> >
> > :>i checked LISTDSI, but it also doesn't tell me if a user lacks of
> > :>authority. is there any built-in REXX function that will tell me if
> > the :>user has proper access authority to a dataset?
> >
> > In general such a function violates security, as it allows the
> > end-user to safely fish for datasets that he may have access to.
> 
> You have to be more specific here.  What you exactly is saying is: if RACF
is stopping a
> user to read a dataset with a message that says that, RACF is violating
the security.
> Maybe you are thinking of a function that checks it without logging in
RACF ?
> 
> 
> 
> Regards
> Thomas Berg
> ____________________________________________________________________
> Thomas Berg   Specialist   z/OS\RQM\IT Delivery   SWEDBANK AB (Publ)
> 
> ----------------------------------------------------------------------
> For TSO-REXX subscribe / signoff / archive access instructions, send email
to
> LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

Sorry Binyamin, that is a red herring that I've heard far too many times.

All that a user who can logon to TSO/ISPF needs to "fish for datasets that he may have access to" is ISPF 3.4 and Browse.  Why is it wrong to have a callable tool to do the same thing that can be done manually?  That just makes no sense at all.

Peter

-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
Sent: Thursday, February 21, 2013 12:28 PM
To: TSO-REXX@vm.marist.edu
Subject: Re: sysdsn - dataset protected

On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
<andreas.fischer@GENERALI.AT> wrote:

:>i'm using the SYSDSN function to determine if a given dsname is ok - and i
:>thought i will also find out when the user doesn't have read access to
:>this dataset. well now i found that this goes only for a dsname including
:>the member name, but not the dsname itself.

:>i checked LISTDSI, but it also doesn't tell me if a user lacks of
:>authority. is there any built-in REXX function that will tell me if the
:>user has proper access authority to a dataset?

In general such a function violates security, as it allows the end-user to
safely fish for datasets that he may have access to.

--

This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On Thu, 21 Feb 2013 18:16:10 -0500 "Farley, Peter x23353"
<Peter.Farley@BROADRIDGE.COM> wrote:

:>Sorry Binyamin, that is a red herring that I've heard far too many times.

:>All that a user who can logon to TSO/ISPF needs to "fish for datasets that he may have access to" is ISPF 3.4 and Browse.  Why is it wrong to have a callable tool to do the same thing that can be done manually?  That just makes no sense at all.

How does he do it in 3.4?

All he can do is attempt the access, and check the result - which will result
in a logging if there is a security failure.

:>-----Original Message-----
:>From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
:>Sent: Thursday, February 21, 2013 12:28 PM
:>To: TSO-REXX@vm.marist.edu
:>Subject: Re: sysdsn - dataset protected
:>
:>On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
:><andreas.fischer@GENERALI.AT> wrote:
:>
:>:>i'm using the SYSDSN function to determine if a given dsname is ok - and i
:>:>thought i will also find out when the user doesn't have read access to
:>:>this dataset. well now i found that this goes only for a dsname including
:>:>the member name, but not the dsname itself.
:>
:>:>i checked LISTDSI, but it also doesn't tell me if a user lacks of
:>:>authority. is there any built-in REXX function that will tell me if the
:>:>user has proper access authority to a dataset?
:>
:>In general such a function violates security, as it allows the end-user to
:>safely fish for datasets that he may have access to.

--
Binyamin Dissen <bdissen@dissensoftware.com>
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

In ISPF 3.4, trying to browse a dataset to which you do not have read access results in a SAF message that you don't have access, a log of the attempted access, and maybe an annoying but functionally useless "abend" message (913-xx), but you are not kicked out of TSO or ISPF as a result.  You just hit the enter key to get rid of the messages and then continue your work.  Why can't a callable tool provide the same functionality (preferably without the useless abend)?  Log the attempt, issue the SAF messages and set a return code that says "You're not allowed read access to that dataset" and just keep going.

Security features should not prevent *attempts* to access, just prevent any actual *access*, report any attempts and move on.  It's up to the human security team to notice any large-scale attempts to access secured files and question the user and/or their manager(s).

Peter


-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
Sent: Friday, February 22, 2013 3:32 AM
To: TSO-REXX@vm.marist.edu
Subject: Re: sysdsn - dataset protected

On Thu, 21 Feb 2013 18:16:10 -0500 "Farley, Peter x23353"
<Peter.Farley@BROADRIDGE.COM> wrote:

:>Sorry Binyamin, that is a red herring that I've heard far too many times.

:>All that a user who can logon to TSO/ISPF needs to "fish for datasets that he may have access to" is ISPF 3.4 and Browse.  Why is it wrong to have a callable tool to do the same thing that can be done manually?  That just makes no sense at all.

How does he do it in 3.4?

All he can do is attempt the access, and check the result - which will result
in a logging if there is a security failure.

:>-----Original Message-----
:>From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Binyamin Dissen
:>Sent: Thursday, February 21, 2013 12:28 PM
:>To: TSO-REXX@vm.marist.edu
:>Subject: Re: sysdsn - dataset protected
:>
:>On Thu, 21 Feb 2013 16:55:05 +0100 Andreas Fischer
:><andreas.fischer@GENERALI.AT> wrote:
:>
:>:>i'm using the SYSDSN function to determine if a given dsname is ok - and i
:>:>thought i will also find out when the user doesn't have read access to
:>:>this dataset. well now i found that this goes only for a dsname including
:>:>the member name, but not the dsname itself.
:>
:>:>i checked LISTDSI, but it also doesn't tell me if a user lacks of
:>:>authority. is there any built-in REXX function that will tell me if the
:>:>user has proper access authority to a dataset?
:>
:>In general such a function violates security, as it allows the end-user to
:>safely fish for datasets that he may have access to.

--

This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On Feb 22, 2013, at 07:50, Farley, Peter x23353 wrote:

> In ISPF 3.4, trying to browse a dataset to which you do not have read access results in a SAF message that you don't have access, a log of the attempted access, and maybe an annoying but functionally useless "abend" message (913-xx), but you are not kicked out of TSO or ISPF as a result.  You just hit the enter key to get rid of the messages and then continue your work.  Why can't a callable tool provide the same functionality (preferably without the useless abend)?  Log the attempt, issue the SAF messages and set a return code that says "You're not allowed read access to that dataset" and just keep going.
>  
Isn't that callable tool "OPEN", or perhaps "EXECIO 0 DISKR ddname (OPEN"?
That doesn't kick you out of Rexx.  Yes, you incur the overhead of
catalog search and allocation, but that's the same as the ISPF 3.4
BROWSE technique.

> Security features should not prevent *attempts* to access, just prevent any actual *access*, report any attempts and move on.  It's up to the human security team to notice any large-scale attempts to access secured files and question the user and/or their manager(s).
>  
Quite agree.  But is the OP looking for a stealth tool that doesn't
get logged?

-- gil

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

In one sense it's very questionable from a point of view of security for one
person to ask about the access rights of another person. Why would you want
to know? So it isn't allowed for mere mortals. But you can always ask RACF
on your own behalf!

-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] On Behalf Of
Paul Gilmartin
Sent: den 22 februari 2013 16:04
To: TSO-REXX@VM.MARIST.EDU
Subject: Re: [TSO-REXX] sysdsn - dataset protected

On Feb 22, 2013, at 07:50, Farley, Peter x23353 wrote:

> In ISPF 3.4, trying to browse a dataset to which you do not have read
access results in a SAF message that you don't have access, a log of the
attempted access, and maybe an annoying but functionally useless "abend"
message (913-xx), but you are not kicked out of TSO or ISPF as a result.
You just hit the enter key to get rid of the messages and then continue your
work.  Why can't a callable tool provide the same functionality (preferably
without the useless abend)?  Log the attempt, issue the SAF messages and set
a return code that says "You're not allowed read access to that dataset" and
just keep going.
>
Isn't that callable tool "OPEN", or perhaps "EXECIO 0 DISKR ddname (OPEN"?
That doesn't kick you out of Rexx.  Yes, you incur the overhead of
catalog search and allocation, but that's the same as the ISPF 3.4
BROWSE technique.

> Security features should not prevent *attempts* to access, just prevent
any actual *access*, report any attempts and move on.  It's up to the human
security team to notice any large-scale attempts to access secured files and
question the user and/or their manager(s).
>
Quite agree.  But is the OP looking for a stealth tool that doesn't
get logged?

-- gil

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On 2/22/2013 3:32 AM, Binyamin Dissen wrote:
> All he can do is attempt the access, and check the result - which 
> will result in a logging if there is a security failure.

Well, sort of.  A RACF SEARCH will tell you if you're specifically
authorized--though not if you're specifically forbidden.  If I have READ
access to HLQ.* and HLQ.LLQ1, I can't tell whether HLQ.LLQ2 is protected
by a more specific profile or not, but I do know I can access HLQ.LLQ1.

�R

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

Adrian, the OP was not asking for *another* user's access, just writing code to be executed by other users in which he wanted his code to check if the *running user* has access.  That is no different than trying to browse a dataset to find out if you have access or not.

Paul, OPEN or EXECIO are the equivalent of browse as you say, but why can't SYSDSN or LISTDSI (or some SAF tool function if necessary) return the same information without the overhead?  How is it a security violation if, as the running user, I ask if *I* (not some *other* userid) have read access to a dataset, fully understanding that by asking the question it will be logged by the SAF?  IMHO that's not a security violation.

Peter

-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@vm.marist.edu] On Behalf Of Adrian Stern
Sent: Friday, February 22, 2013 10:14 AM
To: TSO-REXX@vm.marist.edu
Subject: Re: sysdsn - dataset protected

In one sense it's very questionable from a point of view of security for one
person to ask about the access rights of another person. Why would you want
to know? So it isn't allowed for mere mortals. But you can always ask RACF
on your own behalf!

-----Original Message-----
From: TSO REXX Discussion List [mailto:TSO-REXX@VM.MARIST.EDU] On Behalf Of
Paul Gilmartin
Sent: den 22 februari 2013 16:04
To: TSO-REXX@VM.MARIST.EDU
Subject: Re: [TSO-REXX] sysdsn - dataset protected

On Feb 22, 2013, at 07:50, Farley, Peter x23353 wrote:

> In ISPF 3.4, trying to browse a dataset to which you do not have read
access results in a SAF message that you don't have access, a log of the
attempted access, and maybe an annoying but functionally useless "abend"
message (913-xx), but you are not kicked out of TSO or ISPF as a result.
You just hit the enter key to get rid of the messages and then continue your
work.  Why can't a callable tool provide the same functionality (preferably
without the useless abend)?  Log the attempt, issue the SAF messages and set
a return code that says "You're not allowed read access to that dataset" and
just keep going.
>
Isn't that callable tool "OPEN", or perhaps "EXECIO 0 DISKR ddname (OPEN"?
That doesn't kick you out of Rexx.  Yes, you incur the overhead of
catalog search and allocation, but that's the same as the ISPF 3.4
BROWSE technique.

> Security features should not prevent *attempts* to access, just prevent
any actual *access*, report any attempts and move on.  It's up to the human
security team to notice any large-scale attempts to access secured files and
question the user and/or their manager(s).
>
Quite agree.  But is the OP looking for a stealth tool that doesn't
get logged?

--

This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On Friday 22 February 2013 12:03:09 Adrian Stern wrote:
> As the data delimiters are decided by the programmer the content of the
> members should be irrelevant to the utility since it will not "see" them.
> As far as I know it needs fixed length records, usually in practise F80 but
> again it should work with any fixed length records since it's the fixed bit
> that seems to be important. A small test will tell all.
	Since the input comes via a job stream, record size depends on what JES
allows.

Leslie

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX

On Feb 22, 2013, at 17:21, Leslie Turriff wrote:

> On Friday 22 February 2013 12:03:09 Adrian Stern wrote:
>> As the data delimiters are decided by the programmer the content of the
>> members should be irrelevant to the utility since it will not "see" them.
>> As far as I know it needs fixed length records, usually in practise F80 but
>> again it should work with any fixed length records since it's the fixed bit
>> that seems to be important. A small test will tell all.
> 	Since the input comes via a job stream, record size depends on what JES
> allows.
>  
Which is pretty generous nowadays; hardly a practical limit.  FTP,
however, limits JESLRECL to 254, at least through z/OS 1.12.  (_So_
20th Century.)  I ought to submit an RFE.  Let's not talk about ISPF's
SUBMIT command.

I don't believe input to IEBUPDTE needs to come from a job stream;
in fact I've run it otherwise.  I do believe it has the f-80 limit.
Perhaps I should try a test.

In:  http://publibz.boulder.ibm.com/cgi-bin/bookmgr/BOOKS/DGT2U170/1.4.2

Title: z/OS V1R13.0 DFSMSdfp Utilities
Document Number: SC26-7414-08

I read:
    Utility control statements ... must have fixed or fixed blocked records
    with a logical record length of 80.

11.1 Creating and Updating Data Set Libraries

    IEBUPDTE can be used to create a library of partitioned members,
    if those members have logical record lengths of 80 or less.

(I don't see that it requires fixed.)

11.5.2 Utility Control Statements
                                          
    Requirement: Unlike other utility control statements, all IEBUPDTE
    utility control statements (not including data statements) must begin
    with a "./" (period, slash) in columns 1 and 2.

That delimiter is _not_ decided by the programmer.

Zip, tar, IEBCOPY, VMFPLCD, many others support creating/extracting
archives with members which are themselves archives and/or control
files for the same utility.  IEBUPDTE appears to be in a pitiful
minority.

-- gil

----------------------------------------------------------------------
For TSO-REXX subscribe / signoff / archive access instructions,
send email to LISTSERV@VM.MARIST.EDU with the message: INFO TSO-REXX