The daily edition.

Scope: Rocket Enterprise Developer / Enterprise Server 12.0 for Linux/UNIX (documentation bundle enterprisedevelopereclux_ug_120).

When security is enabled for an enterprise server region, CICS temporary storage (TS) queues and transient data (TD) queues are protected resources like files and programs. The 12.0 documentation states a behavior change that matters when moving applications under security: queues that are not declared in the security repository are no longer left unprotected by default.

What changed

The Resource Classes for CICS Security page carries this note: "In previous releases, security was not enforced for TS or TD queues that were not declared in the security repository. Now, by default, you must declare each TS or TD that your transactions will access."

In practice, queue access follows a deny-by-declaration model. A queue name used by a transaction has to exist as an entity in the security repository, or the security check for it is enforced against an entity that the repository does not hold.

Which resource classes are involved

The same page lists the default CICS security resource classes. Two apply to queues:

• SCICSTST (CICS temporary storage queues): entities are Temporary Storage Queues; the access level is READ or UPDATE.
• DCICSDCT (CICS transient data queues): entities are Transient Data Destinations; the access level is UPDATE.

For comparison, other classes in the same list cover related resources: TCICSTRN for transactions (READ), MCICSPPT for programs (READ), and FCICSFCT and DATASET for files (READ or UPDATE).

The class names can be changed through environment variables. The documentation notes that CICS uses only the first 7 characters of the value specified in the environment variable and then prefixes the value with 1 character depending on the request. Environments that rename classes therefore need the queue declarations made under the renamed classes.

Reverting with ES_OLD_SEC_TSTD

The ES_OLD_SEC_TSTD environment variable prevents security from being enforced for TS or TD queues that are not defined in the security repository. The documented setting is "Any value":

• ES_OLD_SEC_TSTD set to any value: security is not enforced for TS and TD queues that are not defined as entities within the security repository.
• ES_OLD_SEC_TSTD not set, with security enabled: each TS or TD queue that transactions will access must be declared in the security repository.

The variable is documented under "Variables for Configuring MSS Security Behavior".

# Documented: any value reverts to the previous behavior for undeclared TS/TD queues
ES_OLD_SEC_TSTD=Y

The Y shown here is only a placeholder; the documentation specifies that any value has the effect.

Why it matters operationally

The setting is a trade-off between compatibility and coverage. Without the variable, every queue a transaction touches must be inventoried in the repository, which gives queue access the same declared-entity treatment as other resource classes. With the variable, queues absent from the repository are exempt from enforcement, which restores the previous behavior but means those queues are not covered by security rules.

Where queue checks sit among transaction-level controls

Security for queues sits alongside per-transaction options. According to Enabling additional controls, checks made by the CICS subsystem are influenced by two settings in the CICS PCT entry of the transaction:

• Resource Level Security (RLS): controls whether access checks are made for the CICS resources (such as files and queues) specified in EXEC CICS statements.
• Command Security (Cmd): controls whether access checks are made if the program attempts to use any of the CICS System APIs, such as EXEC CICS INQUIRE.

For MSS-based resource security, Resource Security lists transient data queues and temporary storage queues among the resource types a transaction can be controlled against, and notes that by default transactions do not perform resource security checking until it is specified for the transaction (the RLS Security option on the Program Control Table page in ESCWA). The "Enabling additional controls" page states that its guidance assumes the External Security Facility (ESF) has been configured and that a Security Manager using the MLDAP ESM Module or VSAM ESM Module is used for resource access control.

Takeaway

For Enterprise Server 12.0 on Linux/UNIX with security enabled, declare every TS and TD queue that transactions access in the security repository; set ES_OLD_SEC_TSTD only when the earlier behavior of not enforcing security on undeclared queues is intentionally wanted.