A library is defined to Natural Security by creating a library security profile. The library security profile determines the conditions under which the library may be used.

This section covers the following topics:

• Components of a Library Security Profile

• Creating and Maintaining Library Security Profiles

Components of a Library Security Profile

This section covers the following topics:

• Overview of Components

• Components on Main Library Security Profile Screen

• General Options

• Library File

• Library ETID

• Transactions

• Additional Options

• Restrictions

  • Security Options

  • Security Limits

  • Session Parameters (including RPC Restrictions)

  • Command Restrictions

  • Editing Restrictions

  • Statement Restrictions

  • Allow/Disallow modules

  • Set Status of DDMs

  • Development Mode

Overview of Components

Components on Main Library Security Profile Screen

The following type of screen is the "basic" library security profile screen, which is displayed when you invoke one of the functions Add, Copy, Modify, Display for a library security profile:

15:52:08                    *** NATURAL SECURITY ***                 2021-12-31
                               - Modify Library -                              
                                                                                
                                             Modified .. 2021-12-12 by SAG         
Library ID ..... TESTLIB                                                       
Library Name ... ________________________________                              
                                                                               
    General Options            Library File                Transactions        
-----------------------   -----------------------   ---------------------------
People-protected .... N   DBID ........ _____       Startup .......... ________ 
Terminal-protected .. N   FNR ......... _____       Batch execution .. Y       
Restrictions ........ Y   Password .... ________    Restart .......... ________
Logon recorded ...... N   Ciphercode .. ________    Error ............ ________
Utilities ........... O   Read Only ... _                                      
Programming mode .... R                             User exit ........ ________
Cross-reference ..... N                                                        
Restart ............. N                                                        
                                                                              
                                                                               
Additional Options ... N                                                       
                                                                               
                                                                               
                                                                               
                                                                               
Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
      Help  PrevM Exit  AddOp Restr Flip                                Canc   

The individual items you may define as parts of a library security profile are explained below.

General Options

Library File

These items concern:

• the database file where the source programs and object modules contained in the library are to be stored (FUSER).

• the database file where the Predict active cross-references related to the library are to be stored (FDIC).

The FDIC settings can only be specified if the option Library FDIC Assignment Enabled is set to Y in Administrator Services > Library Preset Values.

The FUSER and FDIC values specified here in the library security profile take precedence over the corresponding values of the Natural profile parameters FUSER and FDIC which apply at the start of the Natural session. For values not specified here in the library security profile, the corresponding values of the FUSER and FDIC profile parameters apply.

For Natural system libraries - that is, all libraries whose IDs begin with "SYS" (except the library SYSTEM) - you cannot make any specifications here. For these libraries, the specifications of the Natural profile parameter FNAT apply.

For libraries which are under the control of Predict Application Control, you cannot make any FDIC specifications here. For these libraries, the specifications of the Natural profile parameter FDIC apply.

(¹) The Password and Cipher code fields only apply on z/OS computers, they have no effect under Linux and Windows. To prevent unauthorized access or exposure of sensitive information, each entered value will be masked with an asterisk (*).

For the Natural Development Server environment and Natural servers used in Eclipse, see also the following sections:

• Map Environment and Library Selection under Protecting the Natural Development Server Environment and Applications;

• Map Environment and Library Selection under Protecting the Natural Development Environment in Eclipse.

Library ETID

Transactions

User Exit

With each library security profile and special-link profile, you can store 250 bytes of additional data of your choice.

These additional data can be stored/read by means of a user exit subprogram which must contain a CALLNAT statement (with five parameters as described below) which in turn invokes one of the following subprograms:

These four subprograms are contained in the Natural Security library SYSSEC.

In the User Exit field of the library security profile or special-link profile, you enter the name of the user exit that invokes one of the above subprograms.

To invoke the user exit, you mark User Exit with Y in the Additional Options window (see below).

If you wish to handle the additional data from within a library, you can also invoke the above subprograms by means of a user exit from a library itself. In this case you must copy the subprograms into that library (by using the SYSMAIN utility). When invoked from a library, each subprogram will check and ensure that only data concerning that library or the specified link are read/stored.

In the security profiles of the Natural system libraries, that is, all libraries whose IDs begin with SYS (except the library SYSTEM), you cannot specify a user exit.

SNAASEXT

SNAASEXT is used to store additional library data. It must be invoked with the following five parameters:

SNAAREXT

SNAAREXT is used to read additional library data. It must be invoked with the following five parameters:

When you invoke SNAAREXT or SNAASEXT from a library security profile in SYSSEC, the data will refer to the library you are currently maintaining. When you invoke them from outside SYSSEC, the data will refer to the library from which you invoke the subprogram.

SNAUSEXT

SNAUSEXT is used to store additional special-link data. It must be invoked with the following five parameters:

SNAUREXT

SNAUREXT is used to read additional special-link data. It must be invoked with the following five parameters:

* When you invoke SNAUREXT from outside SYSSEC, you may read several special links to the library by using the 2nd parameter as start value and specifying one of the following operators in the 5th parameter (A2): EQ, =, GT, >, LT, <, GE, >=, LE, <=. These operators determine the read condition as compared against the 2nd parameter. Return code (B2) 0 indicates that the specified special link has been found; any other value indicates that no such link has been found.

When you invoke SNAUREXT or SNAUSEXT from a special-link profile in SYSSEC, the data will refer to the link you are currently maintaining. When you invoke them from outside SYSSEC, the data will refer to the link between the specified user ID and the library from which you invoke the subprogram.

Additional Options

If you mark the field Additional Options on the basic security profile screen with Y, a window will be displayed from which you can select the following options:

• Maintenance Information

• Security Notes

• Owners

• Mailboxes

• Time Windows

• Steplibs

• Restrictions

• Functional Security

• User Exit

The options for which something has already been specified or defined are marked with a plus sign (+).

You can select one or more items from the window by marking them with any character. For each item selected, an additional window/screen will be displayed (in the order of the items in the selection window).

The Restrictions window can also be invoked directly by pressing PF5 on the basic security profile screen.

The individual options are explained below.

Security Options

If you mark Security Options in the Restrictions selection window with any character, the Security Options window will be displayed. In this window, you can set the following options:

Security Limits

If you mark Security Limits in the Restrictions selection window with any character, the Security Limits window will be displayed. In this window, you can set the following limits:

Session Parameters

If you mark Session Parameters in the Restrictions selection window with any character, the Session Parameters screen will be displayed.

On this screen, you can specify values for the following Natural session parameters, which will override the default parameter values set during Natural installation:

If a parameter value is blank (or 0 for a parameter which takes numeric values), the corresponding default value applies.

For information on the individual session/profile parameters, see the Natural Parameter Reference documentation.

Moreover the screen provides the following fields:

Natural RPC Restrictions

When you press PF8 on the Session Parameters screen, another screen will be displayed in which you can set various restrictions that apply when subprograms contained in the library are executed by means of Natural RPC in a client/server environment.

The Natural application programming interfaces USR1071N mentioned above is contained in the library SYSEXT.

For further information on Natural RPC with Natural Security, see the section Protecting Natural RPC Servers and Services in the Natural Security documentation, and the sections Using Natural RPC With Natural Security and Logon To A Server Library in the Natural RPC documentation.

Command Restrictions

If you mark Command Restrictions in the Restrictions selection window with any character, the Command Restrictions screen will be displayed. On this screen, you may allow or disallow the use of individual Natural system commands.

By default, all commands shown on the Command Restrictions screen are marked with Y, which means that all commands are allowed.

• Mark with Y each command you wish to be available for use in the library.

• Mark with N each command you wish not to be used in the library.

For the SCAN command, you can specify the following settings:

• Y - The command is allowed.

• N - The command is not allowed.

• R- The command is allowed; however, its Replace option is not allowed.

• B - The command is allowed; however, its Replace option is only allowed in batch mode (that is, if the Natural system variable *DEVICE is set to BATCH).

• O - The command is allowed; however, its Replace option is only allowed online (that is, if *DEVICE is set to any value other than BATCH).

For information on the individual commands, see the Natural System Commands documentation.

Those commands which are displayed intensified on the Command Restrictions screen use the Natural syntax checker and consequently Natural statements (which may also be allowed/disallowed individually; see Statement Restrictions below).

Restricting the Use of the SCAN Command

You can either disallow the system command SCAN altogether for a library via the Command Restrictions (as described above), or you can control its use via the Utilities option:

• If SCAN is marked with N on the Command Restrictions screen, the SCAN command cannot be used in the library (regardless of the Utilities option).

• If SCAN is marked with Y on the Command Restrictions screen, the Utilities option (in the General Options part of the library security profile) determines who may use the SCAN command in the library. The Utilities option may take one of the following values:

Linux Shell Commands

You can also allow or disallow the execution of Linux shell commands from within a Natural program. These commands are executed from within a Natural program by invoking the Natural user exit SHCMD via the statement CALL SHCMD being issued by the program.

To allow/disallow the execution of shell commands from within a program in the library, you mark CALL SHCMD on the Command Restrictions screen as follows:

• Y = Shell commands can be executed.

• N = Shell commands cannot be executed.

Editing Restrictions

If you mark Editing Restrictions in the Restrictions selection window with any character, the Editing Restrictions window will be displayed. In this window, you may allow or disallow the editing of Natural objects of certain object types.

By default, all object types shown in the Editing Restrictions window are marked with Y, which means that objects of all types may be edited.

• Mark with Y each type of object whose editing you wish to be allowed in the library.

• Mark with N each type of object whose editing you wish not to be allowed in the library.

For information on Natural object types, see the Natural Programming Guide; for information on the Natural editors, see the Natural Editors documentation.

To disallow editing altogether, you may disallow the use of the EDIT command (see Command Restrictions). When you disallow the EDIT command, all object types in the Editing Restrictions window are automatically marked with N. When you allow the EDIT command again, all object types in the Editing Restrictions window are automatically marked with Y again.

Statement Restrictions

If you mark Statement Restrictions in the Restrictions selection window with any character, the Statement Restrictions screen will be displayed. On this and the next screen, you may allow or disallow the use of individual Natural statements. To get from this screen to the next and back again, you press PF7 and PF8 respectively.

By default, all statements shown on the Statement Restrictions screen are marked with Y, which means that all statements are allowed.

• Mark with Y the Natural statements you wish to be allowed for use in the library.

• Mark with N the Natural statements you do not wish to be used in the library.

For the FIND statement and other database access statements, you may also allow/disallow individual clauses.

Any Natural statement which is not listed on the Statements Restrictions screen is always allowed (for example, the statement END).

The Statement Restrictions take effect when a programming object is syntax-checked at compilation.

Disallow/Allow Modules

With this option, you can restrict the use of modules (programming objects) in a library, that is, you can disallow/allow that they can be executed or invoked for execution.

This option may be evaluated differently on different platforms, depending on the option Module Protection Mode, as described in the section Administrator Services.

In the Restrictions selection window, besides the field you mark to select Disallow/Allow Modules, there is a second field in which you can enter one of the following:

If you mark Disallow/Allow Modules in the Restrictions selection window with any character and enter a D or A in the second field, the Disallow Modules screen or Allow Modules screen respectively will be displayed:

11:13:46                    *** Natural Security ***                 2021-12-31
                               - Disallow Modules -                              
   Library  SKYLIB                         0 Module names not held in user buffer
   Module   T Status                 Mark  Module   T Status                 Mark
   --------------------------------------  --------------------------------------
   #CADMIUM P ALLOWED                   _  HELLO    P ALLOWED                   _
   #DANZA   P ALLOWED                   _  HOTTA    P ALLOWED                   _
   #FIFO    P ALLOWED                   _  MEHEECO  P ALLOWED                   _
   #GRACE   P ALLOWED                   _  MOONROOF P ALLOWED                   _
   #PRESTO  P ALLOWED                   _  SAHARA   P ALLOWED                   _
   #TEMPEST P ALLOWED                   _  SCIPIO   P ALLOWED                   _
   CALDANDO P ALLOWED                   _  SKYLARK  P ALLOWED                   _
   CANNBALL P ALLOWED                   _  WESTWAY  P ALLOWED                   _
   CARILLON P ALLOWED                   _  WESTWIND N ALLOWED                   _
   ELCIELO  P ALLOWED                   _  XANGO    M ALLOWED                   _
  *********************  Module Names held in User Buffer  **********************
    ________         ________         ________         ________         ________ 
    ________         ________         ________         ________         ________ 
  -------------------------------------------------------------------------------
  Reposition to .. ________    Display module names not held in UB .. _          
                                                                                 
                                                                                 
  Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
        Help  PrevM Exit  AddOp Restr Flip  -     +     Free  Stepl       Canc  

Column T on the Disallow/Allow Modules screen indicates the object types of the modules:

On the Disallow/Allow Modules screen, mark with D the modules contained in the library you wish to be disallowed; mark with A the modules contained in the library you wish to be allowed. The first ten module names marked will be held in the user buffer.

In addition, the following subfunctions are available:

Set Status of DDMs

This option only affects DDMs for which no security profiles have been defined. It allows you to set the status of all new DDMs to PUBLIC. On z/OS, this applies to the file status; on Linux and Windows, this applies to both the internal and the external status of DDMs.

In the Restrictions window, you can specify one of the following values for this option:

By default, this option is set to UNDF, which means that DDMs for which no security profiles have been defined cannot be used.

If you set this option to PUBL, the status of all DDMs for which no security profiles have been defined is assumed to be PUBLIC, which means that these DDMs can be used. This allows you to use these DDMs without having to define security profiles for them.

For further information, see the sections Protecting DDMs On z/OS and Protecting DDMs On Linux and Windows.

Development Mode

See Library Development Mode Options in the section Protecting the Natural Development Environment in Eclipse.

Creating and Maintaining Library Security Profiles

This section describes the functions used to create and maintain library security profiles. It covers the following topics:

• Invoking Library Maintenance

• Adding a New Library

• Listing Undefined Libraries

• Selecting Existing Libraries for Processing

• Copying a Library

• Modifying a Library

• Renaming a Library

• Deleting a Library

• Displaying a Library

• Creating and Maintaining a Private Library

Invoking Library Maintenance

To invoke library maintenance:

1. On the Main Menu, select Maintenance.

2. A window will be displayed in which you mark the object type Library with a character or with the cursor.

   The Library Maintenance selection list will be displayed.

3. From this selection list, you invoke all library maintenance functions as described below.

Adding a New Library

The Add Library function is used to define new libraries to Natural Security, that is, create library security profiles.

To add a new library security profile:

1. In the command line of the Library Maintenance selection list, enter the command ADD.

2. A window will be displayed in which you enter a library ID and, optionally, the ID of a default profile:

   Library ID

   Library IDs are used by Natural Security to identify libraries and their security profiles. A library ID may be 1 to 8 characters long, it must start with an upper-case alphabetical character, and it must be unique. It may consist of the following characters: upper-case alphabetical characters, numeric characters, hyphen (-) and underscore ( _ ). It must not contain blanks. Before you start defining libraries, it may be advisable to conceive a logical system of library IDs that are related to the library names; this will help you to identify libraries more easily when maintaining them in Natural Security.

   Default Profile

   When you add a new library, you can either type in every item within the library security profile by hand; or you can use a pre-defined default library security profile as the basis for the security profile you are creating. Before you use default library security profiles, you should be familiar with the "normal" way of defining libraries (that is, without default profile). Default profiles are created and maintained in the Administrator Services subsystem. If you specify the ID of a default profile in the Add Library window, the items from the default profile will be copied into the library security profile. On the Add Library screen, you can overwrite the items copied from the default profile, and specify further items. For further information on default library security profiles, see Library Default Profiles in the section Administrator Services.

3. The Add Library screen will be displayed. On this screen, you may define a security profile for the library.

   The Add Library screen and the subsequent screens/windows that may be part of a library security profile as well as the individual items you may define are described under Components of a Library Security Profile.

When you add a new library, the owners specified in your own user security profile are automatically copied into the library security profile.

Listing Undefined Libraries

An undefined library is a library which exists on the system file, but for which no library security profile has been created in Natural Security.

To ascertain which libraries are undefined, you can use the SHOW command. This will expand the Library Maintenance selection list so that it also includes undefined libraries.

The syntax for the SHOW command is as follows:

SHOW ALL [FILE=(database-id,file-number,password,ciphercode)]

or

SHOW + [FILE=(database-id,file-number,password,ciphercode)]

With FILE you specify the system file whose undefined libraries are to be listed. If you omit the FILE specification, the undefined libraries on the current FUSER file will be listed.

The system file to which the expanded list of libraries refers is shown at the top of the Library Maintenance selection list. The Message column of the selection list indicates which of the listed libraries are undefined.

Instead of entering the SHOW ALL command (without FILE specification) in the command line of the Library Maintenance selection list, you can also press PF16.

If you want to list only the undefined libraries, you either enter the command SHOW UNDF (with or without FILE specification) in the command line, or enter UNDF in the protection status field (Prot.).

To revert the Library Maintenance selection list to the standard display of only defined libraries, you press PF16 again or enter the following command in the command line:

SHOW -

To create a security profile for one undefined library:

1. On the Library Maintenance selection list, you mark the library with function code AD or AP.

2. With AP, a window will be displayed in which you can specify the ID of a default profile (see above). With AD, this window will be skipped and no default profile used.

3. The Add Library screen will be displayed - as with Step 3 above.

To create security profiles for multiple undefined libraries:

• On the Library Maintenance selection list, you either mark each of the libraries with function code AD or AP; or you press PF10 to simultaneously select all undefined libraries on the currently displayed page of the Library Maintenance selection list (corresponds to marking them all with AP).

  Steps 2 and 3 will then be repeated for one of the marked/selected libraries after another.

Selecting Existing Libraries for Processing

When you invoke Library Maintenance, a list of all libraries that have been defined to Natural Security will be displayed.

If you do not want a list of all existing libraries but would like only certain libraries to be listed, use the Start Value and Type/Status options as described in the section Finding Your Way In Natural Security.

On the Main Menu, select Maintenance. A window will be displayed.

In the window, mark the object type Library with a character or with the cursor (and, if desired, type in a start value and/or protection status).

The Library Maintenance selection list will be displayed:

 12:47:45                   *** NATURAL SECURITY ***                 2021-12-31
                              - Library Maintenance -                            
                                                                                 
  Co Library ID Library Name                     Prot. Message                   
  __ __________ ________________________________ _____ _____________________     
  __ KETEST                                      YN                              
  __ KEX        TEST APPL-KE                     YN                              
  __ KE1        KETEST                           NN                              
  __ KJH                                         NN                              
  __ KK-APPL                                     NN                              
  __ KKAPP                                       NN                              
  __ KKAPPC                                      NN                              
  __ KKAPP1                                      NN                              
  __ KKAPP2                                      NN                              
  __ KKAPP3                                      NN                              
  __ KKAPP4                                      YN                              
  __ KKAPP7                                      NN                              
  __ KKITEST                                     NN                              
  __ KKPAC                                       NN                              
  __ KKPROD                                      NN                              
                                                                                 
  Command ===>                                                                   
  Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
        Help        Exit              Flip  -     +                       Canc  

For each library, the ID, name and protection status are displayed.

The list can be scrolled as described in the section Finding Your Way In Natural Security. The list can be expanded to also include undefined libraries, as described under Listing Undefined Libraries above.

The following library maintenance functions are available (possible code abbreviations are underlined):

To invoke a function for a library, mark the library with the appropriate function code in column Co.

You may select various libraries for various functions at the same time; that is, you can mark several libraries on the screen with a function code. For each library marked, the appropriate processing screen will be displayed. You may then perform for one library after another the selected functions.

Copying a Library

The Copy Library function is used to define a new library to Natural Security by creating a security profile which is identical to an existing library security profile.

• What is Copied?
• How to Copy
• Copying With Links

What is Copied?

All components of the existing security profile will be copied into the new security profile - except the owners (these will be copied from your own user security profile into the new library security profile).

In addition to duplicating a library security profile, you can choose to also copy its links and utility profiles, as well as the actual library itself; this depends on the options described below.

How to Copy

1. On the Library Maintenance selection list, mark the library whose security profile you wish to duplicate with function code CO.

2. A window will be displayed in which you specify the following:

   Field	Explanation
   To library	Enter the ID of the new library.
   Library name	This field shows the name of the existing library. Overwrite it with the name of the new library.
   With links	Enter Y or N. With this option, you can, in addition to the library security profile, also copy its links, utility profiles and files/DDMs; see Copying With Links below.
   With Natural objects	Enter Y or N. With this option, you can duplicate the actual library itself. This means that a new library will be created on the FUSER system file, and all Natural programming objects contained in the existing library will be copied into this new library. (Internally this option uses the MAINUSER application programming interface of the Natural utility SYSMAIN.)

3. The Copy Library screen will be displayed, showing the new library security profile.

   Its components you may define are described under Components of a Library Security Profile.

Copying With Links

If you select With links = N:

• Any links defined for the existing library will not apply to the new library.

• Any library-specific and user-library-specific utility profiles for the existing library will not apply to the new library.

If you select With links = Y:

• Any links that exist for the existing library are copied for the new library, and you have the option to cancel the links you wish not to apply to the new library.

• Any library-specific and user-library specific utility profiles that exist for the existing library are copied for the new library.

The procedure with With links = Y is as follows:

1. Once you have made any changes to the copied security profile and then leave the Copy Library screen by pressing PF3, a list of users is displayed: it contains all users which are linked to the existing library.

2. On the list, you may mark individual users with CL to cancel any links you wish not to apply to the new library. All users you do not mark will automatically be linked to the new library in the same manner - normal or special link - as the existing library.

3. Once you have established all user links and leave the list of users by pressing PF3, a list of files is displayed: it contains all files/DDMs to which the existing library is linked.

4. On the list, you may mark individual files/DDMs with CL to cancel any links you wish not to apply to the new library. To all files/DDMs you do not mark the new library will automatically be linked in the same manner - read or update link - as the existing library.

Modifying a Library

The Modify Library function is used to change an existing library security profile.

To do so:

1. On the Library Maintenance selection list, you mark the library whose security profile you wish to change with function code MO.

2. The security profile of the selected library will be displayed.

   Its components which you may define or modify are described under Components of a Library Security Profile.

Renaming a Library

The Rename Library function allows you to change the library ID of an existing library security profile.

To do so:

1. On the Library Maintenance selection list, you mark the library whose ID you wish to change with function code RE.

2. A window will be displayed in which you enter a new ID for the library (and, optionally, change its name).

Depending on the setting of the general option Deletion of non-empty libraries allowed (see Administrator Services), it may not be possible to rename a library security profile if the library contains any sources or object modules.

With Natural Objects

When you rename a library security profile, this option allows you to also change the name of the actual library. This means that the library will be renamed on the FUSER system file, and all Natural programming objects contained in the library will be stored under the new library name. (Internally this option uses the MAINUSER application programming interface of the Natural utility SYSMAIN.)

Deleting a Library

The Delete Library function is used to delete an existing library security profile.

To do so:

1. On the Library Maintenance selection list, mark the library you wish to delete with function code DE.

2. The Delete Library window will be displayed.

   • If you decide against deleting the library security profile, leave the window by pressing ENTER without having typed in anything.

   • To delete the library security profile, enter the library's ID in the window to confirm the deletion.

When you delete a library, all existing links to the library will also be deleted.

Depending on the setting of the general option Deletion of Non-empty Libraries Allowed (see Administrator Services), it may not be possible to delete a library security profile if the library still contains any sources or object modules.

If you mark more than one library with DE, a window will be displayed in which you are asked whether you wish to confirm the deletion of each library security profile by entering the library's ID, or whether all libraries selected for deletion are to be deleted without this individual confirmation. Be careful not to delete a library accidentally.

With Natural Objects

When you delete a library security profile, this option allows you to also delete the actual library itself. This means that the library - and all Natural programming objects it contains - will be deleted from the FUSER system file. (Internally this option uses the MAINUSER application programming interface of the Natural utility SYSMAIN.)

Displaying a Library

The Display Library function is used to display an existing library security profile.

To do so:

• On the Library Maintenance selection list, mark the library whose security profile you wish to view with function code DI.

  The security profile of the selected library will be displayed. Its components are described under Components of a Library Security Profile.

Creating and Maintaining a Private Library

• Defining a Private Library
• Maintaining a Private Library
• Deleting a Private Library

Defining a Private Library

The library ID by which a private library is defined to Natural Security is identical to the respective user ID. Therefore private libraries can only be created for users whose user IDs conform to the naming conventions for library IDs.

To define a private library to Natural Security:

1. In the user's security profile, mark the field Private Library with Y (on the Add User, Copy User or Modify User screen) (marking this field does not cause any default private library security profile to be created).

2. In the Additional Options window, select Private Library; or press PF5 on the main user security profile screen.

   A Private Library screen will be displayed. It is identical to a "normal" library security profile screen (except when private libraries are used in private mode, in which case the screen does not contain the fields People-protected and Terminal-protected). On this screen and the subsequent screens/windows you define the security profile for the private library.

Maintaining a Private Library

In private mode, maintenance of existing private library security profiles is performed via User Maintenance.

In public mode, private libraries also appear on the Library Maintenance selection list along with the other libraries, that is, they can be maintained like "normal" libraries with the library maintenance functions described above.

Deleting a Private Library

If private libraries are used in public mode, you delete a private library like any other library (see Deleting a Library).

If private libraries are used in private mode, you delete a private library by marking the Private Library field in the user's security profile with N. A window will be invoked in which you confirm the deletion by typing in the library ID.

Depending on the setting of the general option Deletion of Non-empty Libraries Allowed (see Administrator Services), it may not be possible to delete a private library if it still contains any source or object modules.