I want to stop jobs runing in loop submitted by users.



All about SAF, RACF, encryption, Firewall, Risk assessment and integrity concepts

I want to stop jobs runing in loop submitted by users.

Postby XY09 » Wed Jul 14, 2010 3:52 pm

Hi Guys,

In my shop, couple of trainees(Entry level programers) will do cobol programming. Due lack knowledge in the cobol at initial stage they will run the jobs in loop by mistake.I know less volume of data they will use for processing in the job. I want restrict them once the job CPU reaches 1 min automatically the job should get cancelled by JES2.

I have a solution we can use time parameterr TIME=(0,1) in the job card. Is there anyway we can restrict via RACF (or) any other way.
XY09
 
Posts: 25
Joined: Mon Apr 26, 2010 9:19 am
Has thanked: 0 time
Been thanked: 0 time

Re: I want to stop jobs runing in loop submitted by users.

Postby Robert Sample » Wed Jul 14, 2010 4:45 pm

Talk to your site support group. They may already have something in place to help you. For example, some shops designate a particular job class for short test jobs and having your trainees run their jobs using that class would automatically limit the job. If there is not one already, and your site has a job class not being used, your site support group could change that job class to limit the CPU time -- but this would require a JES restart to implement.

RACF controls access to resources, not time of use, so I am not aware of any way to implement such a limit in RACF.
Robert Sample
Global moderator
 
Posts: 3719
Joined: Sat Dec 19, 2009 8:32 pm
Location: Dubuque, Iowa, USA
Has thanked: 1 time
Been thanked: 279 times

Re: I want to stop jobs runing in loop submitted by users.

Postby steve-myers » Wed Jul 14, 2010 7:22 pm

I agree with Mr Sample; this is not a security issue.

Mr. Sample's idea to use job class for this purpose is legitimate, but realize this is for steps, not for the job.

Many sites impose very restrictive time limits for the default job class.

Using the job class to impose a time limit can backfire, though. I have often been trapped by a small step limit even when the job time is more than adequate for what I was doing.

The step limit can be updated by a JES2 command, though the JES2 parameters would have to be updated and JES2 restarted to make the change "permanent." The comannd is $TJOBCLASSx,TIME=(0,seconds)
steve-myers
Global moderator
 
Posts: 2105
Joined: Thu Jun 03, 2010 6:21 pm
Has thanked: 4 times
Been thanked: 243 times

Re: I want to stop jobs runing in loop submitted by users.

Postby steve-myers » Wed Jul 14, 2010 7:28 pm

Actually, since processor time is a resource, this can be considered a security issue!

However, controls for CPU usage were put in place long before good security systems became common, so the security system was never considered for this purpose.
steve-myers
Global moderator
 
Posts: 2105
Joined: Thu Jun 03, 2010 6:21 pm
Has thanked: 4 times
Been thanked: 243 times


Return to Mainframe Security

 


  • Related topics
    Replies
    Views
    Last post