MVS commands, RACF access authorities, and resource names

This section lists all MVS commands, the RACF access authority associated with them, the RACF resource name for the profile and any explanatory notes:

Table 1. MVS Commands, RACF Access Authorities, and Resource Names
Command/Keyword Authority Resource-Name
ACTIVATE UPDATE MVS™.ACTIVATE
CANCEL device UPDATE MVS.CANCEL.DEV.device
CANCEL jobname UPDATE MVS.CANCEL.JOB.jobname
The previous command is for a job that is not a started task.

CANCEL jobname.id
CANCEL id

 UPDATE MVS.CANCEL.STC.mbrname.id
The previous command is for a started task for which an identifier is provided.
CANCEL jobname UPDATE MVS.CANCEL.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
CANCEL jobname UPDATE MVS.CANCEL.ATX.jobname
The previous command is for APPC transaction programs.
CANCEL U=userid UPDATE MVS.CANCEL.TSU.userid
CHNGDUMP UPDATE MVS.CHNGDUMP
CMDS DISPLAY READ MVS.CMDS.DISPLAY
CMDS DUMP CONTROL MVS.CMDS.DUMP
CMDS FORCE CONTROL MVS.CMDS.FORCE
CMDS SHOW READ MVS.CMDS.SHOW
CMDS REMOVE CONTROL MVS.CMDS.REMOVE
CMDS ABEND CONTROL MVS.CMDS.ABEND
CONFIG CONTROL MVS.CONFIG
CONTROL A READ MVS.CONTROL.A
Note: The access authority for all CONTROL commands except CONTROL M is normally READ, but the L=name (console name) operand can change the access level. When L=name specifies a console that is not full-capability and is not the issuing console, the access authority is UPDATE. When L=name specifies a console that is full-capability and is not the issuing console, the access authority is CONTROL.
CONTROL C
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.C
CONTROL D
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.D
CONTROL E
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.E
CONTROL M CONTROL MVS.CONTROL.M
CONTROL N
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.N
CONTROL Q
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.Q
CONTROL S
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.S
CONTROL V
Note: See the note for the CONTROL A command for exceptions.
 READ MVS.CONTROL.V
DEVSERV READ MVS.DEVSERV
DISPLAY A READ MVS.DISPLAY.JOB
DISPLAY ALLOC,GRPLOCKS READ MVS.DISPLAY.ALLOC
DISPLAY ALLOC,OPTIONS READ MVS.DISPLAY.ALLOC
DISPLAY APPC READ MVS.DISPLAY.APPC
DISPLAY ASCH READ MVS.DISPLAY.ASCH
DISPLAY ASM READ MVS.DISPLAY.ASM
DISPLAY AUTOR READ MVS.DISPLAY.AUTOR
DISPLAY CEE READ MVS.DISPLAY.CEE
DISPLAY CNGRP READ MVS.DISPLAY.CNGRP
DISPLAY CONSOLES READ MVS.DISPLAY.CONSOLES
DISPLAY DIAG READ MVS.DISPLAY.DIAG
DISPLAY DLF READ MVS.DISPLAY.DLF
DISPLAY DUMP READ MVS.DISPLAY.DUMP
DISPLAY EMCS READ MVS.DISPLAY.EMCS
DISPLAY ETR READ MVS.DISPLAY.ETR
DISPLAY GRS READ MVS.DISPLAY.GRS
Start of changeDISPLAY GTZEnd of change Start of changeREADEnd of change Start of changeMVS.DISPLAY.GTZEnd of change
DISPLAY HIS READ MVS.DISPLAY.HIS
DISPLAY HS READ MVS.DISPLAY.HS
DISPLAY IOS READ MVS.DISPLAY.IOS
DISPLAY IPLINFO READ MVS.DISPLAY.IPLINFO
Start of changeDISPLAY IQP End of change Start of changeREADEnd of change Start of changeMVS.DISPLAY.IQPEnd of change
DISPLAY JOBS READ MVS.DISPLAY.JOB
DISPLAY LOGGER READ MVS.DISPLAY.LOGGER
DISPLAY LOGREC READ MVS.DISPLAY.LOGREC
DISPLAY M READ MVS.DISPLAY.M
DISPLAY MMS READ MVS.DISPLAY.MMS
DISPLAY MPF READ MVS.DISPLAY.MPF
DISPLAY MSGFLD READ MVS.DISPLAY.MSGFLD
DISPLAY NET READ MVS.DISPLAY.NET
Start of changeDISPLAY OMVSEnd of change Start of changeREADEnd of change Start of changeMVS.DISPLAY.OMVSEnd of change
DISPLAY OPDATA READ MVS.DISPLAY.OPDATA
DISPLAY PARMLIB READ MVS.DISPLAY.PARMLIB
Start of changeDISPLAY PCIEEnd of change Start of changeREADEnd of change Start of changeMVS.DISPLAY.PCIEEnd of change
DISPLAY PFK READ MVS.DISPLAY.PFK
Start of changeDISPLAY PPTEnd of change Start of changeREADEnd of change Start of changeMVS.DISPLAY.PPTEnd of change
DISPLAY PROD READ MVS.DISPLAY.PROD
DISPLAY PROG READ MVS.DISPLAY.PROG
For DISPLAY PROG,EXIT, if resource CSVDYNEX.LIST exists in the FACILITY class, READ authorization to CSVDYNEX.LIST is required.
DISPLAY R READ MVS.DISPLAY.R
DISPLAY RRS READ MVS.DISPLAY.RRS
DISPLAY SLIP READ MVS.DISPLAY.SLIP
DISPLAY SMF READ MVS.DISPLAY.SMF
DISPLAY SMS READ MVS.DISPLAY.SMS
DISPLAY SSI READ MVS.DISPLAY.SSI
DISPLAY SYMBOLS READ MVS.DISPLAY.SYMBOLS
DISPLAY T READ MVS.DISPLAY.TIMEDATE
DISPLAY TCPIP READ MVS.DISPLAY.TCPIP
Note: See z/OS V2R1.0 Communications Server: IP System Administrator's Commands for more information about DISPLAY TCPIP.
DISPLAY TRACE READ MVS.DISPLAY.TRACE
DISPLAY TS READ MVS.DISPLAY.JOB
DISPLAY U READ MVS.DISPLAY.U
DISPLAY WLM READ MVS.DISPLAY.WLM
DISPLAY XCF READ MVS.DISPLAY.XCF
DUMP CONTROL MVS.DUMP
DUMPDS UPDATE MVS.DUMPDS
FORCE device CONTROL MVS.FORCE.DEV.device
FORCE jobname CONTROL MVS.FORCE.JOB.jobname
The previous command is for a job that is not a started task.

FORCE jobname.id
FORCE id

 CONTROL MVS.FORCE.STC.mbrname.id
The previous command is for a started task for which an identifier was provided.
FORCE jobname CONTROL MVS.FORCE.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
FORCE U=userid CONTROL MVS.FORCE.TSU.userid
FORCE device,ARM CONTROL MVS.FORCEARM.DEV.device
FORCE jobname,ARM CONTROL MVS.FORCEARM.JOB.jobname
The previous command is for a job that is not a started task.
FORCE [jobname.]identifier,ARM CONTROL MVS.FORCEARM.STC.mbrname.id
The previous command is for a started task for which an identifier was provided.
FORCE jobname,ARM CONTROL MVS.FORCEARM.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
FORCE U=userid,ARM CONTROL MVS.FORCEARM.TSU.userid
Start of changeFORCE device,TCB=tcbaddrEnd of change Start of changeCONTROLEnd of change Start of changeMVS.FORCETCB.DEV.deviceEnd of change
Start of changeFORCE jobname,TCB=tcbaddrEnd of change Start of changeCONTROLEnd of change Start of changeMVS.FORCETCB.JOB.jobnameEnd of change
Start of changeThe previous command is for a job that is not a started task.End of change
Start of changeFORCE [jobname.]identifier.TCB=tcbaddrEnd of change Start of changeCONTROLEnd of change Start of changeMVS.FORCETCB.STC.mbrname.idEnd of change
Start of changeThe previous command is for a started task for which an identifier was provided.End of change
Start of changeFORCE jobname,TCB=tcbaddrEnd of change Start of changeCONTROLEnd of change Start of changeMVS.FORCETCB.STC.mbrname.jobnameEnd of change
Start of changeThe previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.End of change
Start of changeFORCE U=userid.TCB=tcbaddrEnd of change Start of changeCONTROLEnd of change Start of changeMVS.FORCETCB.TSU.userid End of change
HALT EOD UPDATE MVS.HALT.EOD
HALT NET UPDATE MVS.HALT.NET
IOACTION CONTROL MVS.IOACTION
LIBRARY UPDATE MVS.LIBRARY
LOG READ MVS.LOG
MODE UPDATE MVS.MODE
MODIFY jobname UPDATE MVS.MODIFY.JOB.jobname
The previous command is for a job that is not a started task.
MODIFY userid UPDATE MVS.MODIFY.JOB.userid

MODIFY jobname
MODIFY jobname.id
MODIFY id

 UPDATE MVS.MODIFY.STC.mbrname.id
The previous command is for a started task for which an identifier was provided.
MODIFY jobname UPDATE MVS.MODIFY.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
Note: MODIFY might actually affect more than one job. For example:
  • If START ABC.DEF and START ABC.GHI are issued, MODIFY ABC.* affects both jobs, and one authorization request is issued for each.
  • If the START ABC command is issued twice, two started tasks named ABC start running on the system. MODIFY ABC affects both jobs, and one authorization request is issued for each.
MONITOR READ MVS.MONITOR
MOUNT UPDATE MVS.MOUNT
PAGEADD UPDATE MVS.PAGEADD
PAGEDEL UPDATE MVS.PAGEDEL
QUIESCE CONTROL MVS.QUIESCE
REPLY READ MVS.REPLY
RESET UPDATE MVS.RESET
RESET CN CONTROL MVS.RESET.CN
ROUTE system READ MVS.ROUTE.CMD.system
Note:
  1. When a system name is specified on the ROUTE command, system is the name of the system that is the target of the command.
  2. When the security profile MVS.CPF.ROUTE.CHECK is defined in the OPERCMDS class, the resource-name MVS.ROUTE.CMD.system is used to validate access authority to using the command prefix facility (CPF) to transport a command to a different system in the sysplex.
ROUTE *ALL READ MVS.ROUTE.CMD.ALLSYSTEMS
ROUTE *OTHER READ MVS.ROUTE.CMD.OTHERSYSTEMS
ROUTE sysgrpname READ MVS.ROUTE.CMD.sysgrpname
ROUTE (sys1,...,sysN) READ MVS.ROUTE.CMD.sys1 
                 .
                 .
MVS.ROUTE.CMD.sysN
ROUTE (group1,...,groupN) READ MVS.ROUTE.CMD.group1 
                 .
                 .
MVS.ROUTE.CMD.groupN
SEND READ MVS.SEND
SET APPC UPDATE MVS.SET.APPC
SET ASCH UPDATE MVS.SET.ASCH
SET AUTOR UPDATE MVS.SET.AUTOR
SET CEE UPDATE MVS.SET.CEE
SET CLOCK UPDATE MVS.SET.TIMEDATE
SET CNGRP UPDATE MVS.SET.CNGRP
Start of changeSET CONEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SET.CONEnd of change
SET DAE UPDATE MVS.SET.DAE
SET DATE UPDATE MVS.SET.TIMEDATE
SET DEVSUP UPDATE MVS.SET.DEVSUP
SET GRSRNL UPDATE MVS.SET.GRSRNL
Start of changeSET GTZEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SET.GTZEnd of change
SET IOS UPDATE MVS.SET.IOS
Start of changeSET IQPEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SET.IQPEnd of change
SET IXGCNF UPDATE MVS.SET.IXGCNF
As part of the SET command, system logger may issue a TRACE CT or a DISPLAY LOGGER command. See z/OS MVS Setting Up a Sysplex for further information about determining message buffer space. for additional required SAF authority.
SET MMS UPDATE MVS.SET.MMS
SET MPF UPDATE MVS.SET.MPF
SET MSGFLD UPDATE MVS.SET.MSGFLD
SET OPT UPDATE MVS.SET.OPT
SET PFK UPDATE MVS.SET.PFK
SET PROG UPDATE MVS.SET.PROG
Note: For examples of how to define RACF® profiles for SET PROG, SETPROG APF, SETPROG EXIT, SETPROG LNKLST and SETPROG LPA, see Examples and MVS Planning Aids for Operations in z/OS MVS Planning: Operations.
SET RESET UPDATE MVS.SET.TIMEDATE
SET SCH UPDATE MVS.SET.SCH
SET SLIP UPDATE MVS.SET.SLIP
SET SMF UPDATE MVS.SET.SMF
SET SMS UPDATE MVS.SET.SMS
SETALLOC UPDATE MVS.SETALLOC.ALLOC
SETAPPC UPDATE MVS.SETAPPC.APPC
SETAUTOR UPDATE MVS.SETAUTOR.AUTOR
SETCEE UPDATE MVS.SETCEE.CEE
Start of changeSETCON DELETEEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SETCON.DELETEEnd of change
SETCON MODE CONTROL MVS.SETCON.MODE
SETCON MONITOR (MN) CONTROL MVS.SETCON.MONITOR
SETETR UPDATE MVS.SETETR.ETR
SETGRS UPDATE MVS.SETGRS.AUTHQLVL
Start of changeSETGRS CNSEnd of change Start of changeCONTROLEnd of change Start of changeMVS.SETGRS.GRSEnd of change

SETGRS MODE=STAR
ENQMAXA
ENQMAXU
CNS
MONITOR

 UPDATE

MVS.SETGRS.TOLINT  
MVS.SETGRS.RESMIL  
MVS.SETGRS.MODE.STAR
MVS.SETGRS.SYNCHRES
MVS.SETGRS.GRSQ    
MVS.SETGRS.ENQMAXA  
MVS.SETGRS.ENQMAXU
MVS.SETGRS.CNS
MVS.SETGRS.MONITOR
Start of changeSETGTZEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SETGTZ.GTZEnd of change
SETIOS UPDATE MVS.SETIOS.IOS
SETHS UPDATE MVS.SETHS
Start of changeSETLOAD xx,IEASYMEnd of change Start of changeUPDATEEnd of change Start of changeMVS.SETLOAD.IEASYMEnd of change
Start of changeSETLOAD xx,PARMLIBEnd of change UPDATE MVS.SETLOAD.LOAD
SETLOGR UPDATE MVS.SETLOGR.LOGR
As part of the SETLOGR command, system logger may issue a TRACE CT or a DISPLAY LOGGER command. See Define authorization for the system logger address space for additional required SAF authority.
SETLOGRC CONTROL MVS.SETLOGRC.LOGRC
SETMF UPDATE MVS.SETMF.MF
SETOMVS UPDATE MVS.SETOMVS.OMVS
SETPROG UPDATE MVS.SETPROG
Note: For examples of how to define RACF profiles for SETPROG, SETPROG APF, SETPROG EXIT, SETPROG LNKLST and SETPROG LPA, see Examples and MVS Planning Aids for Operations in z/OS MVS Planning: Operations.
SETRRS ARCHIVELOGGING UPDATE MVS.SETRRS.ARCHIVELOGGING
SETRRS CANCEL UPDATE MVS.SETRRS.CANCEL
SETRRS SHUTDOWN UPDATE MVS.SETRRS.SHUTDOWN
SETSMF UPDATE MVS.SETSMF.SMF
SETSMS UPDATE MVS.SETSMS.SMS
SETSSI ACTIVATE CONTROL MVS.SETSSI.ACTIVATE.subname
SETSSI ADD CONTROL MVS.SETSSI.ADD.subname
SETSSI DEACTIVATE CONTROL MVS.SETSSI.DEACTIVATE.subname
SETUNI UPDATE MVS.SETUNI.UNI
SETXCF UPDATE MVS.SETXCF.XCF
SLIP UPDATE MVS.SLIP
Note: Start of changeWhen the IEASLIP.REFRESH FACILITY class profile is defined, the SLIP command issuer must have UPDATE access to that profile to use the REFAFTER and REFBEFOR keywords.End of change
START mbrname[.identifier] UPDATE MVS.START.STC.mbrname[.id]
The previous command is for a started task for which an identifier was provided. mbrname is the name of the member containing the JCL source.
START mbrname,JOBNAME=jobname UPDATE MVS.START.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
START commands that use one or more of the following keywords:
  • DSN or DSNAME
  • DISP
  • PROTECT
 UPDATE The resource name substitutes DDALERT for one or more of the keywords.

MVS.START.jobname.qualifier.DDALERT
An example of the previous MVS START command is as follows:

START jobname.qualifier,DSN=dsname.qualifier,DISP=SHR
STOP jobname UPDATE MVS.STOP.JOB.jobname
The previous command is for a job that is not a started task.
STOP userid UPDATE MVS.STOP.JOB.userid

STOP jobname
STOP jobname.id
STOP id

 UPDATE MVS.STOP.STC.mbrname.id
The previous command is for a started task for which an identifier was provided. mbrname is the name of the member containing the JCL source.
STOP jobname UPDATE MVS.STOP.STC.mbrname.jobname
The previous command is for a started task for which an identifier was not provided. mbrname is the name of the member containing the JCL source.
Note: STOP might actually affect more than one started task if more than one unit of work with the same name is active at the same time. If so, there is one call to RACF for command authorization for each unit of work.
STOPMN READ MVS.STOPMN
SWAP UPDATE MVS.SWAP
SWITCH SMF UPDATE MVS.SWITCH.SMF
TRACE CT UPDATE MVS.TRACE.CT
TRACE MT CONTROL MVS.TRACE.MT
TRACE ST UPDATE MVS.TRACE.ST
TRACE STATUS UPDATE MVS.TRACE.STATUS
UNLOAD UPDATE MVS.UNLOAD
VARY CN UPDATE MVS.VARY.CN
VARY CN,ACTIVATE READ MVS.VARY.CN
Note: Issue VARY CN,ACTIVATE only from the system console.
VARY CN,AUTH

UPDATE
CONTROL

MVS.VARY.CN
MVS.VARYAUTH.CN
Note: VARY CN,AUTH requires both profiles.
VARY CN,DEACTIVATE

READ
UPDATE

 MVS.VARY.CN
Note: For the VARY CN,DEACTIVATE command, READ applies only when that command is issued from the system console; otherwise, UPDATE applies.
VARY CN,LOGON

UPDATE
CONTROL

MVS.VARY.CN
MVS.VARYLOGON.CN
Note: VARY CN,LOGON requires both profiles.
VARY CN,LU

UPDATE
CONTROL

MVS.VARY.CN
MVS.VARYLU.CN
Note: VARY CN,LU requires both profiles.
VARY CN,OFFLINE,FORCE

CONTROL

MVS.VARYFORCE.CN
Start of changeVARY CN(...),STANDBY End of change Start of changeCONTROLEnd of change Start of changeMVSVARYSTANDBY.CNEnd of change
VARY CONSOLE UPDATE MVS.VARY.CONSOLE
VARY CONSOLE,AUTH

UPDATE
CONTROL

MVS.VARY.CONSOLE
MVS.VARYAUTH.CONSOLE
Note: VARY CONSOLE,AUTH requires both profiles.
VARY CU CONTROL MVS.VARY.CU
VARY CU,FORCE CONTROL MVS.VARYFORCE.CU
VARY GRS CONTROL MVS.VARY.GRS
VARY HARDCPY CONTROL MVS.VARY.HARDCPY
VARY NET UPDATE MVS.VARY.NET
VARY OFFLINE UPDATE MVS.VARY.DEV
Note: If VARY CN,OFFLINE is specified, the rules for VARY CN apply (the system checks for UPDATE access to MVS.VARY.CN, not MVS.VARY.DEV).
VARY OFFLINE,FORCE CONTROL MVS.VARYFORCE.DEV
VARY ONLINE UPDATE MVS.VARY.DEV
Note: If VARY CN,ONLINE is specified, the rules for VARY CN apply (the system checks for UPDATE access to MVS.VARY.CN, not MVS.VARY.DEV).
VARY PATH UPDATE MVS.VARY.PATH
VARY SMS UPDATE MVS.VARY.SMS
VARY TCPIP UPDATE MVS.VARY.TCPIP
Note: See z/OS V2R1.0 Communications Server: IP System Administrator's Commands for more details and information on necessary profiles for MVS.VARY.TCPIP command.
VARY WLM CONTROL MVS.VARY.WLM
VARY XCF CONTROL MVS.VARY.XCF
WRITELOG READ MVS.WRITELOG
Parent topic: Changing console characteristics