RACF data set access behavior

Question

If a dataset has a discrete profile defined and also falls under a generic dataset profile, which access rule is applied?

For e.g. there is a discrete dataset profile A.B.C with ALTER access defined for user A. There is also a generic dataset profile A.B.** with READ access defined for user B.

Will user B be able to read dataset A.B.C?

In that particular case I believe yes, user B will be allowed to read dataset A.B.C but will not be allowed to edit, — paulywill, Jun 29 '18 at 14:20
What is the UACC, if any, on the rule for the discrete profile? — zarchasmpgmr, Jun 29 '18 at 15:07
This _may_ be on topic for the [proposed mainframe SE site](https://area51.stackexchange.com/proposals/118484/mainframes). — cschneid, Jun 29 '18 at 15:08

score 1 · Answer 1 · answered Jul 16 '18 at 13:29

If a data set is protected by both a generic profile and a discrete profile, the discrete profile sets the level of protection for the data set. If a data set is protected by multiple generic profiles, the most specific generic profile sets the level of protection for the data set.

From Choosing between discrete and generic profiles. This publication is for 2.1 but I guess it will apply to 2.2 and 2.3 also.

In other words you can use a generic profile for A.B.* to restrict the access to the user and at the same time make a discrete profile to grant access for A.B.C.

score 0 · Answer 2 · answered Jun 29 '18 at 15:47

Since there is a discrete dataset profile defined for A.B.C, that profile will be used for access checks. If access is needed for B then B would also need to be permitted in some manner to the discrete dataset profile. This is from experimentation only, but the IBM documentation for the RACHECK marco hints at this behavior with its discussion of the GENERIC parameter.

RACF data set access behavior

2 Answers2