Create an API for IFI reads (306) so Log-Reading Software does NOT need to be APF-Authorized

Like a lot of shops, we replicate a lot of our Enterprise data from our programmatic Db2 for z/OS environment to other Db2s and other off-platform DBMSes for MI and analytics, and for high availability.

IIDR now provides the ability to do this via a "Remote Capture Engine", which drives stored procedures on the mainframe to read Db2's logs via IFI306, eliminating the need to spend mainframe cycles or memory on actually processing replication activities...this is now done on a "commodity" server.

The problem with this is that the IIDR group has chosen to deploy these stored procedures that call IFI306 to the z/OS platform via SSH. And because the IFI306 read requires that the code be APF-authorized, this means IBM wants us to allow IIDR to load modules DIRECTLY into an APF-authorized library via SSH.

Code loaded into an APF-authorized library has the ability, if link-edited with AC=1, to issue ANY privileged instruction on the z/OS operating system, including loading PSWs, changing storage keys/masks, or starting IO/subchannel programs. A bad-actor skilled in Assembler programming could potentially inject high-risk code into a z/OS system via SSH with little auditability, potentially compromising the security of the z/OS platform.

Solution:

The only reason the target library needs to be APF-authorized for this deployment is because the IFI 306 call to DB2 needs to run APF-authorized. So a potential solution would be to deploy an API within Db2 itself, placing the APF-portion of the code in the Db2 SDSNLOAD as part of the Db2 product.