0000879: Support SAF request in SW implementations for key access and other resources

Notes
(0001258) Falk Reichbott (administrator) 2019-06-13 12:46	Hallo Herr Schöller Danke für dieses Issue, wir werden dem nachgehen. Grundsätzlich ist es in sich aber schon flasch, was hier passiert. Sie lesen ein FLAMFILE, was als Member einen KSDS enthält und dieses wird als PSVB vom FLUC in eine temporäre Datei geschrieben. Dann startet die CLIST den ISPF-Editor, sie ändern auf der temproären Datei rum und wollen nun mit PF3 speichern. Sprich der ISPF-Editor beendet sich und die überschriebene temproäre Datei wird nun mit dem Inverskommende über den FLUC von der CLIST zurückgeschrieben. Was sie hierbei erhalten, wenn es keinen Fahler geben würde, ist ein PSVB-Member in dem FLAMFILE, was glaube ich nicht ihren Erwartungen entspricht. Denn sie hoffen, dass dies ein KSDS ist oder? Dies wird über FLVEDIT nicht funktionieren. Da ja von Ihnen die nativen Records und kein XML oder ähnliches bearbeitet wird, sollten sie hier mit FLEDIT arbeiten, dann sollte es gehen. Das Protokoll, was sie uns geschickt haben, zeigt aber eindeutig, dass wir hier einen Bug haben, denn wir, sofern wir ihn nachvollziehen können fixen, so dass ein PSVB-Member nach dem PF3 in dem FLAMFILE steht. Hier wieder einen KSDS als Member zu erzeugen, ist leider nicht möglich, denn dafür müste die Temporäre Datei ein KSDS sein, was ja nicht geht. Also FLVEDIT macht nur für PS sinn. Weil es nach PS überführt. Der FLUC kann nur sequentiell lesen und schreiben. Mfg Falk Reichbott

(0001260) Falk Reichbott (administrator) 2019-06-13 13:01	Hallo Herr Schöller Habe gerade mit der FLAM4-Fraktion gesprochen und FLEDIT hat das gleiche Problem, wie FLVEDIT und in ihrem Fall ist das FLAMFILE selbst noch ein VSAM-KSDS, wo wir nicht zurückschrieben dürfen, was der FF.0000E8 besagt. MfG Falk Reichbott

(0001268) Falk Reichbott (administrator) 2019-06-17 16:02	A first set of additional SAF checks are implemented SAF configuration ~~~~~~~~~~~~~~~~~ Since version 5.1.21 FLAM supports additional SAF checks for the classes and entities below. Each FLAM class starts with '$FL'. To be backward compatible with previous releases, an undefined resource (return code 4) will be accepted by default. This also forces that the prefix cannot be changed. Only a return code greater or equal 8 will result in an authorization or license error. With the first class the 6 byte long feature code can be controlled. CLASS: '$FLFEATR' - Feature de/activation Entities: Are equal to FLAM feature names (show in your license) Attribute: 'READ' deactivates the feature Attribute: 'ALTER' activates the feature This support will fail with a license error. The class is global and is only available if a new license module requested. All checks below are part of the FL5 components, can be controlled over a global master class and will result in an authorization error. CLASS: '$FLGLOBL' - Global master class to activate several SAF checks Entity: 'MUSTDEF' - Don't accept return code 4 anything must be defined Attribute: 'READ' activate the strong SAF checking (return code must be 0 else fail) Attribute: 'ALTER' only simple SAF checking active (return code must >=8 to fail) Entity: 'POLICIES' - General policies ($FLPOLCY) Entity: 'CLP.CONTROL' - Parameter string ($FLCLPAR) Entity: 'AVE.CONTROL' - Anti virus exit ($FLAV) Entity: 'CPE.CONTROL' - Column processing exit ($FLCP) Entity: 'KME.CONTROL' - Key management exit ($FLKM) Entity: 'SSH.CONNECT' - SSH connections ($FLSSH) Entity: 'PGP.KEYMNGM' - PGP key management ($FLPGP*) Entity: 'SMF.LOGGING' - Enforce SMF-Logging Entity: 'PGP.USERID' - Access to user ids ($FLPGUID) Entity: 'PGP.KEYID' - Access to key ids ($FLPGKID) Attribute: 'READ' activate the SAF checking Attribute: 'ALTER' allow to do this without SAF The classes below are control by the global master above: CLASS: '$FLPOLCY' - Several policies Entity: 'SSH.PCAP.NOT.ALLOWED' - Packet capturing is not allowed Entity: 'SSH.WAEK.HOST.KEY.CHECK.NOT.ALLOWED' - WARN and ACCEPT is not allowed Entity: 'SSH.CUSTOM.HOST.KEY.NOT.ALLOWED' - A custom host key is not allowed Entity: 'SSH.CUSTOM.KNOWN.HOST.FILE.NOT.ALLOWED' - A custom known host key file is not allowed Entity: 'KEY.GENERATE.PGP.EXPIRD.REQIRED' - Expiration date required Entity: 'KEY.GENERATE.PGP.ALGO.RSA.LEN1024' - Minimum 1024 bit required Entity: 'KEY.GENERATE.PGP.ALGO.RSA.LEN2048' - Minimum 2048 bit required Entity: 'KEY.GENERATE.PGP.ALGO.RSA.LEN3072' - Minimum 3072 bit required Entity: 'KEY.GENERATE.PGP.ALGO.RSA.LEN4096' - Minimum 4096 bit required Entity: 'KEY.GENERATE.PGP.ALGO.DSA.NOT.ALLOWED' - DSA algorithm is not allowed Entity: 'KEY.GENERATE.PGP.ALGO.DSA.LEN1024' - Minimum 1024 bit required Entity: 'KEY.GENERATE.PGP.ALGO.DSA.LEN2048' - Minimum 2048 bit required Entity: 'KEY.GENERATE.PGP.ALGO.DSA.LEN3072' - Minimum 3072 bit required Entity: 'KEY.GENERATE.PGP.ALGO.DSA.LEN4096' - Minimum 4096 bit required Entity: 'KEY.IMPORT.PGP.KIDVER.REQ04' - A minimum of 4 byte finger print for import Entity: 'KEY.IMPORT.PGP.KIDVER.REQ08' - A minimum of 8 byte finger print for import Entity: 'PGP.READ.PWD' - Read with passwords is not allowed (enforce PKA) Entity: 'PGP.WRITE.PWD' - Write with passwords is not allowed (enforce PKA) Entity: 'PGP.REENC.PWD' - Re encryption with passwords is not allowed (enforce PKA) Entity: 'PGP.READ.ENFORCE.ENCRYPTION' - Enforce encryption at read of PGP files Entity: 'PGP.READ.ENFORCE.INTEGRITY' - Enforce integrity protection at read of PGP files Entity: 'PGP.READ.ENFORCE.SIGNING' - Enforce signing at read of PGP files Entity: 'PGP.WRITE.ENFORCE.ENCRYPTION' - Enforce encryption at write of PGP files Entity: 'PGP.WRITE.ENFORCE.INTEGRITY' - Enforce integrity protection at write of PGP files Entity: 'PGP.WRITE.ENFORCE.SIGNING' - Enforce signing at write of PGP files Attribute: 'READ' enforced the policy Attribute: 'ALTER' allow to do this CLASS: '$FLCLPAR' - Command line parser Entities: Path to this parameter Attribute: 'READ' not allowed Attribute: 'ALTER' can be used CLASS: '$FLSSHUS' - SSH user Entities: SSH user id Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLSSHHO' - SSH host Entities: IP oder DSN for SSH daemon Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLSSHPO' - SSH port Entities: Port of SSH daemon (decimal number) Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLAVLIB' - FAVE library Entities: Library name name Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLAVFUC' - FAVE Function Entities: Function name used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLAVPAR' - FAVE Parameter Entities: Parameter string used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLAVIPH' - FAVE IP host Entities: IP address of AV daemon Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLAVIPS' - FAVE IP service/port Entities: IP service of AV daemon Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLCPLIB' - FCPE library Entities: Library name name Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLCPFUC' - FCPE Function Entities: Function name used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLCPPAR' - FCPE Parameter Entities: Parameter string used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLKMLIB' - FKME library Entities: Library name name Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLKMFUC' - FKME Function Entities: Function name used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLKMPAR' - FKME Parameter Entities: Parameter string used Attribute: 'READ' not usable Attribute: 'ALTER' can be used CLASS: '$FLPGPGN' - PGP generate Entities: User ID to be generated Attribute: 'READ' not allowed Attribute: 'ALTER' can be done CLASS: '$FLPGPEX' - PGP export Entities: User ID to be exported Attribute: 'READ' not allowed Attribute: 'ALTER' can be done CLASS: '$FLPGPIM' - PGP import Entities: User ID to be imported Attribute: 'READ' not allowed Attribute: 'ALTER' can be done CLASS: '$FLPGPDL' - PGP delete Entities: User ID to be deleted Attribute: 'READ' not allowed Attribute: 'ALTER' can be done CLASS: '$FLPGUID' - Operational PGP user Entities: User ID mainly at write Attribute: 'READ' not allowed Attribute: 'ALTER' can be done CLASS: '$FLPGKID' - Operational PGP key ID Entities: Key ID at read and write Attribute: 'READ' not allowed Attribute: 'ALTER' can be done

Issue History
Date Modified	Username	Field	Change
2017-06-12 08:19	Falk Reichbott	New Issue
2017-06-12 08:19	Falk Reichbott	Status	new => assigned
2017-06-12 08:19	Falk Reichbott	Assigned To	=> Mykhailo Moldavskyy
2017-06-12 08:27	Falk Reichbott	Relationship added	related to 0000880
2017-08-31 16:51	Falk Reichbott	Target Version	5.1.16 => 5.1.18
2018-06-18 09:36	Falk Reichbott	Target Version	5.1.18 => 5.1.19
2018-08-01 09:00	Falk Reichbott	Target Version	5.1.19 => 5.1.20
2018-11-02 12:50	Falk Reichbott	Assigned To	Mykhailo Moldavskyy => Falk Reichbott
2019-02-28 17:33	Falk Reichbott	Target Version	5.1.20 => 5.1.21
2019-06-13 12:46	Falk Reichbott	Note Added: 0001258
2019-06-13 12:47	Falk Reichbott	Product Version	5.1.15 => 5.1.19
2019-06-13 13:01	Falk Reichbott	Note Added: 0001260
2019-06-17 16:02	Falk Reichbott	Note Added: 0001268
2019-06-17 16:02	Falk Reichbott	Status	assigned => resolved
2019-06-17 16:02	Falk Reichbott	Fixed in Version	=> 5.1.21
2019-06-17 16:02	Falk Reichbott	Resolution	open => fixed