Version 6.3.3	SEARCH   INDEX   CONTENTS   |   PDF BOOKS   |   HOME   UP   PREV   NEXT

A library is defined to Natural Security by creating a library security profile. The library security profile determines the conditions under which the library may be used.

This section covers the following topics:

• Components of a Library Profile

• Creating and Maintaining Library Profiles

Components of a Library Profile

This section covers the following topics:

• Overview of Components

• Components on Main Library-Profile Screen

• General Options

• Library File

• Transactions

• Additional Options

• Restrictions

  • Security Options

  • Security Limits

  • Session Parameters (including RPC Restrictions)

  • Command Restrictions

  • Editing Restrictions

  • Statement Restrictions

  • Allow/Disallow modules

  • Set Status of DDMs

Overview of Components

Components on Main Library-Profile Screen

The following type of screen is the "basic" library security profile screen, which appears when you invoke one of the functions Add, Copy, Modify, Display for a library security profile:

14:00:00                   *** NATURAL SECURITY ***                  2007-08-13
                                - Modify Library -                               
                                                                                 
                                              Modified .. 2007-04-20 by SAG      
  Library ID ..... TESTLIB                                                       
  Library Name ... ________________________________                              
                                                                                 
      General Options            Library File                Transactions        
  -----------------------   -----------------------   ---------------------------
  People-protected .... Y   DBID ........ _____       Startup .......... ________
  Terminal-protected .. N   FNR ......... _____       Batch execution .. Y       
  Restrictions ........ Y   Password .... ________    Restart .......... ________
  Logon recorded ...... Y   Ciphercode .. ________    Error ............ ________
  Utilities ........... O                                                        
  Programming mode .... R                             User exit ........ ________
  Cross-reference ..... N                                                        
  Restart ............. Y                                                        
                                                                                 
                                                                                 
  Additional Options ... N                                                       
                                                                                 
                                                                                 
  Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
        Help  PrevM Exit  AddOp Restr Flip                                Canc  

The individual items you may define as parts of a library security profile are explained below.

General Options

Library File

The items under Library File concern the database file where the source programs and object modules contained in the library are to be stored.

Note:
For the Natural system libraries - that is, all libraries whose IDs begin with "SYS" (except the library SYSTEM) - you cannot enter a DBID, FNR, password, or cipher code. For these libraries the DBID, FNR, password, and cipher code of the Natural profile parameter FNAT (described in the Natural Parameter Reference documentation) as defined in the Natural parameter module/file invariably apply.

Transactions

INPUT (SG=OFF) #ERROR (N4)
               #LINE  (N4)
               #STATUS(A1)
               #PGM   (A8)
               #LEVEL (N2)

User Exit

With each library profile and special link profile, you can store 250 bytes of additional data of your choice.

These additional data can be stored/read by means of a user exit subprogram which must contain a CALLNAT statement (with five parameters as described below) which in turn invokes one of the following subprograms:

• SNAASEXT - to store additional library data,

• SNAAREXT - to read additional library data,

• SNAUSEXT - to store additional special link data,

• SNAUREXT - to read additional special link data.

These four subprograms are contained in the Natural Security library SYSSEC.

In the User Exit field of the library profile or special link profile, you enter the name of the user exit that invokes one of the above subprograms.

To invoke the user exit, you mark "User Exit" with "Y" in the Additional Options window (see below).

If you wish to handle the additional data from within a library, you can also invoke the above subprograms by means of a user exit from a library itself. In this case you must copy the subprograms into that library (by using the SYSMAIN utility). When invoked from a library, each subprogram will check and ensure that only data concerning that library or the specified link are read/stored.

In the security profiles of the Natural system libraries, that is, all libraries whose IDs begin with "SYS" (except the library SYSTEM), you cannot specify a user exit.

SNAASEXT

SNAASEXT is used to store additional library data. It must be invoked with the following five parameters:

SNAAREXT

SNAAREXT is used to read addtional library data. It must be invoked with the following five parameters:

When you invoke SNAAREXT or SNAASEXT from a library profile in SYSSEC, the data will refer to the library you are currently maintaining.

When you invoke SNAAREXT or SNAASEXT from outside SYSSEC, the data will refer to the library from which you invoke the subprogram.

SNAUSEXT

SNAUSEXT is used to store additional special link data. It must be invoked with the following five parameters:

SNAUREXT

SNAUREXT is used to read additional special link data. It must be invoked with the following five parameters:

* When you invoke SNAUREXT from outside SYSSEC, you may read several special links to the library by using the 2nd parameter as start value and specifying one of the following operators in the 5th parameter (A2): "EQ", "=", "GT", ">", "LT", "<", "GE", ">=", "LE", "<=". These operators determine the read condition as compared against the 2nd parameter. Return code (B2) "0" indicates that the specified special link has been found; any other value indicates that no such link has been found.

When you invoke SNAUREXT or SNAUSEXT from a special link profile in SYSSEC, the data will refer to the link you are currently maintaining. When you invoke SNAUREXT or SNAUSEXT from outside SYSSEC, the data will refer to the link between the specified user ID and the library from which you invoke the subprogram.

Additional Options

If you mark the field "Additional Options" on the basic security profile screen with "Y", a window will be displayed from which you can select the following options:

• Maintenance Information

• Security Notes

• Owners

• Mailboxes

• Time Windows

• Steplibs

• Restrictions

• Functional Security

• User Exit

The options for which something has already been specified or defined are marked with a plus sign (+).

You can select one or more items from the window by marking them with any character. For each item selected, an additional window/screen will be displayed (in the order of the items in the selection window).

The Restrictions window can also be invoked directly by pressing PF5 on the basic security profile screen.

The individual options are explained below.

Security Options

If you mark "Security Options" in the Restrictions selection window with any character, the Security Options window will be displayed. In this window, you can set the following options:

Security Limits

If you mark "Security Limits" in the Restrictions selection window with any character, the Security Limits window will be displayed. In this window, you can set the following limits:

Session Parameters

If you mark "Session Parameters" in the Restrictions selection window with any character, the Session Parameters screen will be displayed.

On this screen, you can specify values for the following Natural session parameters, which will override the default parameter values set during Natural installation:

If a parameter value is blank (or "0" for a parameter which takes numeric values), the corresponding default value applies.

For information on the individual session/profile parameters, see the Natural Parameter Reference documentation.

Moreover the screen provides the following fields:

Natural RPC Restrictions

When you press PF8 on the Session Parameters screen, another screen will be displayed in which you can set various restrictions that apply when subprograms contained in the library are executed by means of Natural RPC in a client/server environment.

The Natural application programming interfaces USR1071 and USR2071 mentioned above are contained in library SYSEXT.

For further information on Natural RPC with Natural Security, see the section Protecting Natural RPC Servers and Services in the Natural Security documentation, and the sections Using Natural RPC With Natural Security and Logon To A Server Library in the Natural Remote Procedure Call documentation.

Command Restrictions

If you mark "Command Restrictions" in the Restrictions selection window with any character, the Command Restrictions screen will be displayed. On this screen, you may allow or disallow the use of individual Natural system commands.

By default, all commands shown on the Command Restrictions screen are marked with "Y", which means that all commands are allowed.

• Mark with "Y" each command you wish to be available for use in the library.

• Mark with "N" each command you wish not to be used in the library.

For the SCAN command, you can specify the following settings:

• "Y" - The command is allowed.

• "N" - The command is not allowed.

• "R"- The command is allowed; however, its Replace option is not allowed.

• "B" - The command is allowed; however, its Replace option is only allowed in batch mode (that is, if the Natural system variable *DEVICE is set to "BATCH").

• "O" - The command is allowed; however, its Replace option is only allowed online (that is, if *DEVICE is set to any value other than "BATCH").

For information on the individual commands, see the Natural System Commands documentation.

Those commands which are displayed intensified on the Command Restrictions screen use the Natural syntax checker and consequently Natural statements (which may also be allowed/disallowed individually; see Statement Restrictions below).

Restricting the Use of the SCAN Command

You can either disallow the system command SCAN altogether for a library via the Command Restrictions (as described above), or you can control its use via the Utilities option:

• If SCAN is marked with "N" on the Command Restrictions screen, the SCAN command cannot be used in the library (regardless of the Utilities option).

• If SCAN is marked with "Y" on the Command Restrictions screen, the Utilities option (in the General Options part of the library profile) determines who may use the SCAN command in the library. The Utilities option may take one of the following values:

Editing Restrictions

If you mark "Editing Restrictions" in the Restrictions selection window with any character, the Editing Restrictions window will be displayed. In this window, you may allow or disallow the editing of Natural objects of certain object types.

By default, all object types shown in the Editing Restrictions window are marked with "Y", which means that objects of all types may be edited.

• Mark with "Y" each type of object whose editing you wish to be allowed in the library.

• Mark with "N" each type of object whose editing you wish not to be allowed in the library.

For information on Natural object types, see the Natural Programming Guide; for information on the Natural editors, see the Natural Editors documentation.

To disallow editing altogether, you may disallow the use of the EDIT command (see Command Restrictions above). When you disallow the EDIT command, all object types in the Editing Restrictions window are automatically marked with "N". When you allow the EDIT command again, all object types in the Editing Restrictions window are automatically marked with "Y" again.

Statement Restrictions

If you mark "Statement Restrictions" in the Restrictions selection window with any character, the Statement Restrictions screen will be displayed. On this and the next screen, you may allow or disallow the use of individual Natural statements. To get from this screen to the next and back again, you press PF7 and PF8 respectively.

By default, all statements shown on the Statement Restrictions screen are marked with "Y", which means that all statements are allowed.

• Mark with "Y" the Natural statements you wish to be allowed for use in the library.

• Mark with "N" the Natural statements you do not wish to be used in the library.

For the FIND statement and other database access statements, you may also allow/disallow individual clauses.

Any Natural statement which is not listed on the Statements Restrictions screen is always allowed (for example, the statement END).

The Statement Restrictions take effect when a programming object is syntax-checked at compilation.

Disallow/Allow Modules

With this option, you can restrict the use of modules (programming objects) in a library, that is, you can disallow/allow that they can be executed or invoked for execution.

In the Restrictions selection window, besides the field you mark to select "Disallow/Allow Modules", there is a second field, in which you can enter one of the following:

Note:
For the Display function, you can only mark the selection field; regardless of the setting of the second field, the Disallow/Allow Modules screen will be displayed showing the list of allowed/disallowed modules.

If you mark "Disallow/Allow Modules" in the Restrictions selection window with any character and enter a "D" or "A" in the second field, the Disallow Modules screen or Allow Modules screen respectively will be displayed:

11:13:46                    *** Natural Security ***                 2007-08-28
                               - Disallow Modules -                              
   Library  SKYLIB                         0 Module names not held in user buffer
   Module   T Status                 Mark  Module   T Status                 Mark
   --------------------------------------  --------------------------------------
   #CADMIUM P ALLOWED                   _  HELLO    P ALLOWED                   _
   #DANZA   P ALLOWED                   _  HOTTA    P ALLOWED                   _
   #FIFO    P ALLOWED                   _  MEHEECO  P ALLOWED                   _
   #GRACE   P ALLOWED                   _  MOONROOF P ALLOWED                   _
   #PRESTO  P ALLOWED                   _  SAHARA   P ALLOWED                   _
   #TEMPEST P ALLOWED                   _  SCIPIO   P ALLOWED                   _
   CALDANDO P ALLOWED                   _  SKYLARK  P ALLOWED                   _
   CANNBALL P ALLOWED                   _  WESTWAY  P ALLOWED                   _
   CARILLON P ALLOWED                   _  WESTWIND N ALLOWED                   _
   ELCIELO  P ALLOWED                   _  XANGO    M ALLOWED                   _
  *********************  Module Names held in User Buffer  **********************
    ________         ________         ________         ________         ________ 
    ________         ________         ________         ________         ________ 
  -------------------------------------------------------------------------------
  Reposition to .. ________    Display module names not held in UB .. _          
                                                                                 
                                                                                 
  Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
        Help  PrevM Exit  AddOp Restr Flip  -     +     Free  Stepl       Canc  

Column T on the Disallow/Allow Modules screen indicates the object types of the modules:

On the Disallow/Allow Modules screen, mark with "D" the modules contained in the library you wish to be disallowed; mark with "A" the modules contained in the library you wish to be allowed. The first ten module names marked will be held in the user buffer.

In addition, the following subfunctions are available:

Set Status of DDMs

This option only affects DDMs for which no security profiles have been defined. It allows you to set the status of all new DDMs to PUBLIC. On mainframes, this applies to the file status; on UNIX and Windows, this applies to both the internal and the external status of DDMs.

In the Restrictions window, you can specify one of the following values for this option:

By default, this option is set to "UNDF", which means that DDMs for which no security profiles have been defined cannot be used.

If you set this option to "PUBL", the status of all DDMs for which no security profiles have been defined is assumed to be PUBLIC, which means that these DDMs can be used. This allows you to use these DDMs without having to define security profiles for them.

For further information, see the sections Protecting DDMs On Mainframes and Protecting DDMs On UNIX and Windows .

Creating and Maintaining Library Profiles

This section describes the functions used to create and maintain library profiles. It covers the following topics:

• Invoking Library Maintenance

• Adding a New Library

• Selecting Existing Libraries for Processing

• Copying a Library

• Modifying a Library

• Renaming a Library

• Deleting a Library

• Displaying a Library

• Creating and Maintaining a Private Library

Invoking Library Maintenance

On the Main Menu, enter code "M" for "Maintenance". A window will be displayed.

In the window, mark object type "Library" with a character or with the cursor. The Library Maintenance selection list will be displayed.

From this selection list, you invoke all library maintenance functions as described below.

Adding a New Library

The Add Library function is used to define new libraries to Natural Security, that is, create library security profiles.

Note:
To create library security profiles for system libraries (that is, libraries whose names begin with "SYS") more easily, you can use the Administrator Services function "System-library definitions", which provides predefined security profiles for most system libraries.

To add a new library security profile, enter the command ADD in the command line of the Library Maintenance selection list.

A window will appear. In this window, you enter a library ID (and, optionally, the ID of a default profile).

The Add Library screen will be displayed. On this screen, you may define a security profile for the library.

The Add Library screen and the subsequent screens/windows that may be part of a library security profile as well as the individual items you may define are described under Components of a Library Profile above.

When you add a new library, the owners specified in your own user security profile will automatically be copied into the library security profile you are creating.

Library ID

Library IDs are used by Natural Security to identify libraries and their security profiles.

A library ID may be 1 to 8 characters long, it must start with an upper-case alphabetical character, and it must be unique. A library ID must not contain blanks. It may consist of the following characters: upper-case alphabetical characters, numeric characters, hyphen (-) and underscore ( _ ).

Before you start defining libraries, it may be advisable to conceive a logical system of creating library IDs that are related to the library names, as this will help you to identify libraries more easily when maintaining Natural Security.

Default Profile

When you add a new library, you can either type in every item within the library security profile by hand; or you can use a pre-defined default library profile as the basis for the security profile you are creating.

Before you use default library profiles, you should be familiar with the "normal" way of defining libraries (that is, without default profile).

Default profiles are created and maintained in the Administrator Services subsystem.

If you specify the ID of a default profile in the Add Library window, the items from the default profile will be copied into the library profile

On the Add Library screen, you can overwrite the items copied from the default profile, and specify further items.

For further information on default library profiles, see Library Default Profiles in the section Administrator Services.

Selecting Existing Libraries for Processing

When you invoke Library Maintenance, a list of all libraries that have been defined to Natural Security will be displayed.

If you do not wish to get a list of all existing libraries but would like only certain libraries to be listed, you may use the Start Value and Type/Status options as described in the section Finding Your Way In Natural Security.

On the Main Menu, enter code "M" for "Maintenance". A window will be displayed. In the window, mark object type "Library" with a character or with the cursor (and, if desired, type in a start value and/or protection status). The Library Maintenance selection list will be displayed:

 12:47:45                   *** NATURAL SECURITY ***                 2007-08-13
                              - Library Maintenance -                            
                                                                                 
  Co Library ID Library Name                     Prot. Message                   
  __ __________ ________________________________ _____ _____________________     
  __ KETEST                                      YN                              
  __ KEX        TEST APPL-KE                     YN                              
  __ KE1        KETEST                           NN                              
  __ KJH                                         NN                              
  __ KK-APPL                                     NN                              
  __ KKAPP                                       NN                              
  __ KKAPPC                                      NN                              
  __ KKAPP1                                      NN                              
  __ KKAPP2                                      NN                              
  __ KKAPP3                                      NN                              
  __ KKAPP4                                      YN                              
  __ KKAPP7                                      NN                              
  __ KKITEST                                     NN                              
  __ KKPAC                                       NN                              
  __ KKPROD                                      NN                              
                                                                                 
  Command ===>                                                                   
  Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
        Help        Exit              Flip  -     +                       Canc  

For each library, the ID, name and protection status are displayed.

The list can be scrolled as described in the section Finding Your Way In Natural Security.

The following library maintenance functions are available (possible code abbreviations are underlined):

To invoke a function for a library, mark the library with the appropriate function code in column "Co".

You may select various libraries for various functions at the same time; that is, you can mark several libraries on the screen with a function code. For each library marked, the appropriate processing screen will be displayed. You may then perform for one library after another the selected functions.

Copying a Library

The Copy Library function is used to define a new library to Natural Security by creating a security profile which is identical to an existing library security profile.

What is Copied?

All components of the existing security profile will be copied into the new security profile - except the owners (these will be copied from your own user security profile into the new library security profile you are creating).

In addition to duplicating a library profile, you can choose to also copy its links and utility profiles, as well as the actual library itself; this depends on the options described below.

How to Copy

On the Library Maintenance selection list, mark the library whose security profile you wish to duplicate with function code "CO".

A window will be displayed. In this window, specify the following:

The Copy Library screen will be displayed, showing the new library security profile.

The individual components of the security profile you may define or modify are described under Components of a Library Profile above.

With Links

If you leave the "N" in the "with links" field of the Copy Library window:

• any links defined for the existing library will not apply to the new library;

• any library-specific and user-library-specific utility profiles for the existing library will not apply to the new library.

If you enter a "Y" in the "with links" field of the Copy Library window:

• any links that exist for the existing library are copied for the new library, and you have the option to cancel the links you wish not to apply to the new library;

• any library-specific and user-library specific utility profiles that exist for the existing library are copied for the new library.

The procedure is as follows:

1. Once you have made any changes to the copied security profile and then leave the Copy Library screen by pressing PF3, a list of users is displayed: it contains all users which are linked to the existing library.

2. On the list, you may mark individual users with "CL" to cancel any links you wish not to apply to the new library; all users you do not mark will automatically be linked to the new library in the same manner - normal or special link - as the existing library.

3. Once you have established all user links and leave the list of users by pressing PF3, a list of files is displayed: the list contains all files/DDMs to which the existing library is linked.

4. On the list, you may mark individual files/DDMs with "CL" to cancel any links you wish not to apply to the new library; to all files/DDMs you do not mark the new library will automatically be linked in the same manner - read or update link - as the existing library.

Modifying a Library

The Modify Library function is used to change an existing library security profile.

On the Library Maintenance selection list, you mark the library whose security profile you wish to change with function code "MO". The security profile of the selected library will be displayed.

The individual components of the security profile you may define or modify are described under Components of a Library Profile above.

Renaming a Library

The Rename Library function allows you to change the library ID of an existing library security profile.

On the Library Maintenance selection list, you mark the library whose ID you wish to change with function code "RE".

A window will be displayed in which you can enter a new ID for the library (and, optionally, change its name).

Depending on the setting of the general option "Deletion of non-empty libraries allowed" (as explained in the section Administrator Services), it may not be possible to rename a library security profile if the library contains any sources or object modules.

With Natural Objects

When you rename a library profile, this option allows you to also change the name of the actual library. This means that the library will be renamed on the FUSER system file, and all Natural programming objects contained in the library will be stored under the new library name. (Internally this option uses the MAINUSER application programming interface of the Natural utility SYSMAIN.)

Deleting a Library

The Delete Library function is used to delete an existing library security profile.

On the Library Maintenance selection list, you mark the library you wish to delete with function code "DE". A window will be displayed.

• If you have invoked the Delete Library function and should then decide against deleting the given library security profile, you may leave the Delete Library window by pressing ENTER without having typed in anything.

• If you wish to delete the given library security profile, enter the library's ID in the window to confirm the deletion.

When you delete a library, all existing links to the library will also be deleted.

Depending on the setting of the general option "Deletion of Non-empty Libraries Allowed" (described in the section Administrator Services), it may not be possible to delete a library security profile if the library still contains any sources or object modules.

If you mark more than one library with "DE", a window will appear in which you are asked whether you wish to confirm the deletion of each library security profile by entering the library's ID, or whether all libraries selected for deletion are to be deleted without this individual confirmation. Be careful not to delete a library accidentally.

With Natural Objects

When you delete a library profile, this option allows you to also delete the actual library itself. This means that the library - and all Natural programming objects it contains - will be deleted from the FUSER system file. (Internally this option uses the MAINUSER application programming interface of the Natural utility SYSMAIN.)

Displaying a Library

The Display Library function is used to display an existing library security profile.

On the Library Maintenance selection list, you mark the library whose security profile you wish to view with function code "DI". The security profile of the selected library will be displayed.

The individual components of the security profile are described under Components of a Library Profile above.

Creating and Maintaining a Private Library

Defining a Private Library

To define a private library to Natural Security, first mark the "Private Library" field in the user's security profile with "Y" (on the Add User, Copy User or Modify User screen) (marking this field does not cause any default private library profile to be created).

In the Additional Options window, you then select "Private Library"; or you press PF5 on the main user profile screen.

A Private Library screen will be displayed; the screen is identical to a "normal" library security profile screen (except when private libraries are used in private mode, in which case the screen does not contain the fields "People-protected" and "Terminal-protected"). On this screen and the subsequent screens/windows you define the security profile for the private library.

The library ID by which a private library is defined to Natural Security is identical to the respective user ID.

Maintaining a Private Library

In private mode, maintenance of existing private library profiles is performed via User Maintenance.

In public mode, private libraries also appear on the Library Maintenance selection list along with the other libraries, that is, they can be maintained like "normal" libraries with the library maintenance functions described above.

Deleting a Private Library

If private libraries are used in public mode, you delete a private library like any other library (see Deleting a Library above).

If private libraries are used in private mode, you delete a private library by marking the "Private Library" field in the user's security profile with "N". A window will be invoked in which you confirm the deletion by typing in the library ID.

Depending on the setting of the general option "Deletion of Non-empty Libraries Allowed" (described in the section Administrator Services), it may not be possible to delete a private library if it still contains any source or object modules.

www.softwareag.com

Copyright © Software AG 1992-2008. All rights reserved.

SEARCH   INDEX   CONTENTS   |   PDF BOOKS   |   HOME   UP   PREV   NEXT