APSYSEC parameter

Sirius APSY security flags

Summary

Default value

X'00'

Parameter type

System

Where set

User 0 CCAIN parameters

Related products

Prior to Version 7.5 of Model 204, this parameter required the SirSafe product.

Introduced

Sirius Mods 6.7

Description

The APSYSEC parameter makes it possible for a system manager to enter SUBSYSMGMT and DICTADMIN (Dictionary/204 administration) without prior authorization. It also allows a system manager to START, STOP, DEBUG, or TEST any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE), without having to add the system manager to the SCLASS authorized to do these things.

For versions of Model 204 prior to 7.5, setting this parameter has no effect at sites not authorized for SirSafe.

The APSYSEC parameter is a bitmask parameter where the bits mean:

X'01'

System managers are allowed to enter SUBSYSMGMT and DICTADMIN without prior authorization. System managers are also allowed to START, STOP, DEBUG, or TEST any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE). System managers cannot use SUBSYSMGMT or DICTADMIN unless another system manager, who has privileges to use those subsystems, gives them access through SUBSYSMGMT and DICTADMIN. When employee turnover and retirements leave no one with those privileges, new system managers cannot get access. In addition to those privileges, the authority to issue START, STOP, TEST and DEBUG commands saves the effort of adding a system manager to a privileged SCLASS in every subsystem in an Online so that the system manager could at least start and stop the subsystems — a common thing for system managers to need to do. In fact, if no users other than system managers need to start or stop subsystems, this can eliminate the need to even have sclasses in a subsystem to allow starting or stopping of the subsystem. In some cases, eliminating this need can reduce the subsystem definition to a single default sclass, which has performance benefits — no sclass lookup is required when a user enters a subsystem, and no sclass-specific compilations are done for the procedures in the subsystem. Because of the overhead associated with multiple sclasses in a subsystem (not huge, but possibly measurable), some sites take the risk of adding START and STOP privileges (and perhaps TEST and DEBUG) to the one and only sclass for a subsystem. This, of course, means that any user can start and stop the subsystem, which might not be ideal from a control or security perspective. The APSYSEC parameter allows such a site to keep one sclass but remove the risk. START and STOP privileges can be removed from the default/only sclass for a subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems. To continue using Model 204's traditional fine-grained control of granting access to run SUBSYSMGMT and DICTADMIN through those subsystems and grant control of START, STOP, TEST, and DEBUG privileges, the APSYSEC X'01' bit should not be set.