4 ms·

> Unix is more permissive, mainframe is more tight That sounds interesting, any examples? The usual complaint about Unix is lack of fine-grain control over fil

> Unix is more permissive, mainframe is more tight That sounds interesting, any examples? The usual complaint about Unix is lack of fine-grain control over filesystem, but in practice this does not seem to be a problem, there are ACLs, selinux, etc. Is the situation better on mainframes?

js8 6y ago
Yes, in general security is controlled through ACLs on the mainframe. Execution of system programs is also limited. But I think it goes deeper, basically lots of resources are limited or require additional security access, so if something fails, the damage it can cause (due to overuse of resources) is limited. I don't know if there is anything you can't do on Linux, except perhaps pervasive encryption, which allows to have some file operations (such as backups) running on encrypted files that the user (under which the backup or restore is running) cannot read. There are also some really old things that would be considered unsafe today, but IBM is gradually fixing and deprecating them. This is pretty much because historically, z/OS was quite customizable, and lot of user space programs (utilities and middleware, not applications) had pretty intimate hooks into the operating system. Also the auditing (not only in security) is excellent. The visibility into what the mainframe system is doing is unmatched on any other platform, I think.
- p_l 6y ago
  Even today z/OS has a lot of "exits" that are, literally, addresses in system binaries where you can place address to your own routine (which is linked directly to the OS) which will get called if system does a certain action. Anyone who spent more time with emulating MVS (and possibly with weird accent emulating z/OS ;) ) probably encountered things like the assembly routine that you can link into every MVS version since 3.8 (all the way to recent z/OS) which hijacks tape mount requests before they are sent to operator, enabling you to connect whatever kind of tape-switching you want - in this case, doing special Hercules magic to change the tape image based on one of the parameters.

js8 6y ago

Yes, in general security is controlled through ACLs on the mainframe. Execution of system programs is also limited. But I think it goes deeper, basically lots of resources are limited or require additional security access, so if something fails, the damage it can cause (due to overuse of resources) is limited. I don't know if there is anything you can't do on Linux, except perhaps pervasive encryption, which allows to have some file operations (such as backups) running on encrypted files that the user (under which the backup or restore is running) cannot read. There are also some really old things that would be considered unsafe today, but IBM is gradually fixing and deprecating them. This is pretty much because historically, z/OS was quite customizable, and lot of user space programs (utilities and middleware, not applications) had pretty intimate hooks into the operating system. Also the auditing (not only in security) is excellent. The visibility into what the mainframe system is doing is unmatched on any other platform, I think.

p_l 6y ago
Even today z/OS has a lot of "exits" that are, literally, addresses in system binaries where you can place address to your own routine (which is linked directly to the OS) which will get called if system does a certain action. Anyone who spent more time with emulating MVS (and possibly with weird accent emulating z/OS ;) ) probably encountered things like the assembly routine that you can link into every MVS version since 3.8 (all the way to recent z/OS) which hijacks tape mount requests before they are sent to operator, enabling you to connect whatever kind of tape-switching you want - in this case, doing special Hercules magic to change the tape image based on one of the parameters.