RDJFCB Security

OPEN TYPE=J compares the volume serial numbers specified in the user-supplied JFCB with the volume serial numbers in the system's copy of the JFCB. Each different volume serial number will be enqueued exclusively. The volumes stay enqueued until the job step terminates, because the CLOSE routines will not dequeue the volumes. If the job step already has the volume open, OPEN TYPE=J continues. If the volume is enqueued by another job step, an ABEND 413 occurs with a return code of X'04'.

Some JFCB modifications can compromise the security of existing password-protected or RACF-protected data sets. The following modifications are specifically not allowed, unless the program making the modifications is authorized (an authorized program is one that is either in supervisor state, executing in one of the system protection keys (keys 0 through 7), or authorized under the authorized program facility) or can supply the password:

Changing the disposition of a password-protected data set from OLD or MOD to NEW.
Changing the data set name or one or more of the volume serial numbers when the disposition is NEW.
Changing the label processing specifications to bypass label processing.

Changing the data set name in the JFCB has no effect on the name of the data set. You are just referring to a different data set. If the DISP setting is NEW, it does not cause the changed data set name to be created. If OPEN allocates the changed data set name, it is as if the DD had DISP=OLD. To create a data set on DASD, your program should call dynamic allocation by issuing SVC 99 (Requesting Dynamic Allocation Functions in z/OS MVS Programming: Authorized Assembler Services Guide). Alternately your program might be able to use the REALLOC macro, but note that it requires authorization and carries restrictions. See Creating (Allocating) a DASD Data Set Using REALLOC.