On z/OS, can I use RACF so that I can only READ my own dataset and not UPDATE it?

Question

I want to make the dataset 'FULTONM.MY.FILE' read-only to everyone including me.

I issue:

addsd 'FULTONM.MY.FILE' GEN UACC(NONE)"

I then issue:

listdsd dataset('FULTONM.MY.FILE')

which prints out:

INFORMATION FOR DATASET FULTONM.MY.FILE (G)

LEVEL  OWNER    UNIVERSAL ACCESS   WARNING   ERASE
-----  -------- ----------------   -------   -----
 00    FULTONM         NONE          NO      NO

AUDITING
--------
FAILURES(READ)

NOTIFY
--------
NO USER TO BE NOTIFIED

YOUR ACCESS  CREATION GROUP  DATASET TYPE
-----------  --------------  ------------
   ALTER        CDEV           NON-VSAM

NO INSTALLATION DATA

Now I want to restrict everyone's access (including me: FULTONM) to just READ. I issued:

tsocmd "permit 'FULTONM.MY.FILE' ID(*) ACCESS(READ) GENERIC"
tsocmd "listdsd da('FULTONM.MY.FILE') GENERIC"

But I can still update the file, and I see no change in the LISTDSD output?

If I issue:

tsocmd "listdsd da('FULTONM.MY.FILE') GENERIC all"

I do see:

   ID     ACCESS
--------  -------
*          READ

but I am still able to update the dataset.

Answer 1

You cannot limit access to your own data sets, i.e. data sets of which the high level qualifier (HLQ) matches your userid.

From the RACF manual z/OS Security Server RACF - Security Administrator's Guide -> "Debugging problems in the RACF database" -> "Authorizing access to RACF-protected resources":

16. If users attempt to access their own resources, RACF grants the request. For example:

    o For tape and DASD data sets, if the user ID of the requesting user is the high-level qualifier of the data set name, RACF grants the request.

Note that this describes standard behaviour assuming no RACF exit is doing special things.

Answer 2

My guess is that there is an entry in the global access table that gives you ALTER access to your own datasets.

For example, the following entry allows users to have ALTER access to data sets that begin with their own user IDs. RALTER GLOBAL DATASET ADDMEM('&RACUID.**'/ALTER)

https://www.ibm.com/docs/en/zos/2.4.0?topic=table-creating-global-access-checking-entries

https://www.ibm.com/docs/en/zos/2.4.0?topic=table-how-global-access-checking-works