- Generated on for FOBJ-SPI by
1.18.0
Bit flags passed in TsFobjOpn.uiFlg at open time. More...
Macros | |
| #define | FOBJ_FLAG_WRITE 0x00000001U |
| [INPUT] Write access requested (0 = read-only). | |
| #define | FOBJ_FLAG_OVERWRITE 0x00000002U |
| [INPUT] Overwrite existing archive (reset to empty, version 1 fresh). Set together with FOBJ_FLAG_WRITE when the caller requested store.objuser() with the OVERWRITE option. Without this flag a write OPN must fail if the archive already exists. | |
| #define | FOBJ_FLAG_LOG 0x00000004U |
| [INPUT] Enable info-level logging from the OBJSSE bridge and the provider (operational events: provider loaded, OPN/CLS lifecycle). Corresponds to the LOGGING switch in store.objuser() CLEP params. Providers may ignore this flag; it is primarily consumed by OBJSSE. | |
| #define | FOBJ_FLAG_DEBUG 0x00000008U |
| [INPUT] Enable debug-level logging from the OBJSSE bridge and the provider (per-operation detail: PUT/GET key, CHK result, etc.). Corresponds to the DEBUG switch in store.objuser() CLEP params. Has no effect unless FOBJ_FLAG_LOG is also set. | |
| #define | FOBJ_FLAG_TRACE 0x00000010U |
| [INPUT] Enable debug trace output by the provider. | |
| #define | FOBJ_FLAG_ACCESS 0x00000040U |
| [INPUT] SAF authorization checks are active for this provider invocation (GLOBAL.OBU.CONTROL defined in RACF $FLAM class). The bridge checked library and function name at FLACACS_READ level (FOBJLIB and FOBJFUC resource classes). See SAF flag semantics table above. | |
| #define | FOBJ_FLAG_STRONG 0x00000080U |
| [INPUT] Set together with FOBJ_FLAG_ACCESS when RACF is in strict mode (GLOBAL.MUSTDEF=UPDATE or lower): an undefined resource (RACF RC=4) exceeds the FL5 threshold and causes an abort. In permissive mode (threshold=8) RC=4 is silently accepted and this flag is not set. When set, namespace and parameter were explicitly approved in RACF (FOBJPTH, FOBJPAR). See SAF flag semantics table above. | |
Bit flags passed in TsFobjOpn.uiFlg at open time.
The OBJSSE bridge sets all input flags before calling FOBJ_FUNC_OPN. The provider must not modify input flags.
On z/OS, the OBJSSE bridge can perform RACF authorization checks on the provider parameters before loading the library. The checks are controlled by the GLOBAL.OBU.CONTROL entity in the $FLAM RACF resource class (see the FL5 z/OS installation guide, SAF chapter).
FOBJ_FLAG_ACCESS signals that SAF checking is active for this provider call. The bridge checks the library name (FOBJLIB resource class) and function name (FOBJFUC resource class) at FLACACS_READ level.
FOBJ_FLAG_STRONG additionally signals that RACF is configured in strict mode (GLOBAL.MUSTDEF active at UPDATE or lower level). RACF always returns RC=4 for an undefined resource. In permissive mode the FL5 threshold is 8, so RC=4 is silently accepted. In strict mode the threshold is <= 4, so RC=4 also causes an authorization error and abort. When STRONG is set, the provider can therefore rely on the namespace (FOBJPTH) and parameter (FOBJPAR) having been explicitly approved in RACF – a missing definition would have aborted the call.
| ACCESS | STRONG | Meaning |
|---|---|---|
| 0 | 0 | No SAF checks performed (OBU.CONTROL not active) |
| 1 | 0 | SAF checks active; RACF permissive (MUSTDEF=CONTROL |
| or not defined): RC=4 for undefined resource is | ||
| accepted – no explicit RACF approval guaranteed | ||
| 1 | 1 | SAF checks active; RACF strict (MUSTDEF=UPDATE or |
| lower): RC=4 causes abort – namespace and parameter | ||
| were explicitly defined and approved in RACF |
External providers may ignore both flags. Internal FLAM providers may use them to decide whether to enforce additional resource checks.
| #define FOBJ_FLAG_ACCESS 0x00000040U |
[INPUT] SAF authorization checks are active for this provider invocation (GLOBAL.OBU.CONTROL defined in RACF $FLAM class). The bridge checked library and function name at FLACACS_READ level (FOBJLIB and FOBJFUC resource classes). See SAF flag semantics table above.
| #define FOBJ_FLAG_DEBUG 0x00000008U |
[INPUT] Enable debug-level logging from the OBJSSE bridge and the provider (per-operation detail: PUT/GET key, CHK result, etc.). Corresponds to the DEBUG switch in store.objuser() CLEP params. Has no effect unless FOBJ_FLAG_LOG is also set.
| #define FOBJ_FLAG_LOG 0x00000004U |
[INPUT] Enable info-level logging from the OBJSSE bridge and the provider (operational events: provider loaded, OPN/CLS lifecycle). Corresponds to the LOGGING switch in store.objuser() CLEP params. Providers may ignore this flag; it is primarily consumed by OBJSSE.
| #define FOBJ_FLAG_OVERWRITE 0x00000002U |
[INPUT] Overwrite existing archive (reset to empty, version 1 fresh). Set together with FOBJ_FLAG_WRITE when the caller requested store.objuser() with the OVERWRITE option. Without this flag a write OPN must fail if the archive already exists.
| #define FOBJ_FLAG_STRONG 0x00000080U |
[INPUT] Set together with FOBJ_FLAG_ACCESS when RACF is in strict mode (GLOBAL.MUSTDEF=UPDATE or lower): an undefined resource (RACF RC=4) exceeds the FL5 threshold and causes an abort. In permissive mode (threshold=8) RC=4 is silently accepted and this flag is not set. When set, namespace and parameter were explicitly approved in RACF (FOBJPTH, FOBJPAR). See SAF flag semantics table above.
| #define FOBJ_FLAG_TRACE 0x00000010U |
[INPUT] Enable debug trace output by the provider.
| #define FOBJ_FLAG_WRITE 0x00000001U |
[INPUT] Write access requested (0 = read-only).
1.18.0