IBM Z Software
This portal is to open public enhancement requests against IBM Z Software products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).
Shape the future of IBM!
We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:
Search existing ideas
Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,
Post your ideas
Post an idea.
Get feedback from the IBM team and other customers to refine your idea.
Follow the idea through the IBM Ideas process.
Specific links you will want to bookmark for future use
Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.
IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.
ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.
HIGH
Low priority. Some security concerns here.
My Interpretation after contacting the RFE submitter is that this is not (directly) a RACF security issue, but a NetView internal security issue. Usually issuing command "EXCMD cccccccc" to issue command cccccccc under a different auto-operator is only allowed with SECOPTS.AUTCHK=SOURCEID if the command issuer has authority for BOTH EXCMD AND cccccccc.
INGHWCMD is a strange exception to this rule which lets a user issue EXCMD INGHWCMD in this setting without having authority to issue INGHWCMD.
This is the security issue addressed by the RFE. We think this should not be possible.
MEDIUM
Medium.
Medium - If INGHWCMD is not being protected by RACF then that's not good. Performance due to RACF shouldn't be a problem I'd have thought, as the BCPii is known to be slow(er) anyway. Slower than RACF at least :-)
Low
N/A
My experience with SAF checking on commands has been that command-intense scenarios can be tremendously slowed by the number of SAF(RACF) calls. If INGHWCMD is being handled in a unique fashion (which is how I interpreted the RFE) then it should be consistent. However, GDPS should evaluate whether a performance-sensitive function could be affected by a change.
Creating a new RFE based on Community RFE #80201 in product GDPS.