IBM Data and AI Ideas Portal for Customers
This portal is to open public enhancement requests against products and services offered by the IBM Data & AI organization. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).
Shape the future of IBM!
We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:
Search existing ideas
Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,
Post your ideas
Post ideas and requests to enhance a product or service. Take a look at ideas others have posted and upvote them if they matter to you,
Post an idea
Upvote ideas that matter most to you
Get feedback from the IBM team to refine your idea
Specific links you will want to bookmark for future use
Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.
IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.
ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.
IBM Employees should enter Ideas at https://ideas.ibm.com
This idea is being closed as there is not enough customer interest.
Hello,
This is an excellent idea. I have been thinking about opening this RFE/Idea for the last couple of days, and know I have asked about it before.
I have tried in the past to impress upon IBM how sensitive APF-authorized libraries are at our organization. Our security auditors are constantly flagging us on how many people have access to these libraries, and how often changes are made. It is a MAJOR inconvenience for us, and a recurring point of contention during security audits, that we have to update an APF-authorized library to change Db2 system parameters.
This is rightly so, since someone with access to an APF-authorized library and a knowledge of system Assembler could pretty much "do anything" on a mainframe/zOS system, issue any privileged instruction, reference any piece of memory, even start subchannels.
I understand why IBM did this - because they wanted to load the parms in the STEPLIB concatenation and the STEPLIB has to be APF-authorized. We should have moved beyond this by now, though, and IBM should be providing a way to update ZPARMs, particularly online-updateable ZPARMs, without having to modify an APF-authorized library. The DSNZPARM module contains no code, so there is NO reason for it to be APF-authorized except for IBM wanting to load it from the STEPLIB.
I think it would be prudent to keep certain parameters in the SDSNEXIT-based parameter modules:
* Security-related settings and things you want to be ultra-secure
* Settings that shouldn't change, such as those in DSNHDECP and DSNHMCID
* Non-online-updateable ZPARMs
However, all other parameters SHOULD be changeable without updating an APF-authorized library.
A couple of ways IBM could do this:
> Add a new DD to the MSTR JCL, potentially something like //ZPARM DD DISP=SHR, DSN=hlq.DB2.SDSNPARM, and allow specification of ZPARM values in simple plain-text PDS members instead of having to link-edit a ZPARM. Db2 could load these values into memory at startup or whenever a SET SYSPARM RELOAD was issued.
> Do something similar to what is done with bufferpool settings - store the parameter values in the bootstrap dataset and provide -DISPLAY ZPARM and -ALTER ZPARM commands to dynamically change those properties.
> Provide a Db2 catalog table, something like SYSIBM.SYSZPARMS, where parameters could be set and queried.
I'm sure since this has been marked for "future consideration", IBM already has some ideas on how to implement. But with cybersecurity coming front-and-center in mainframe shops as well as distributed and Cloud implementations, eliminating as many updates to APF libraries as possible is becoming VERY important.