bbarker's questions

It is often pointed out that each user has their own (virtual) address space in in z/OS; this is said as if it is a good thing, and I suppose it is compared to real mode. But in most modern systems I'm used to most processes (or jobs, in z/OS parlance, I suppose) having their own address space. This Unix approach seems strictly more secure at first glance.

That said, I have heard it claimed that z/OS jobs also each get their own address space, but I haven't seen any official documentation for this. Of course, if a user can only run one job at a time (I haven't checked this), then certainly this would not be an issue. (Aside: Traditionally z/OS must have been used for batch processing, so that might be a reasonable assumption. But, it is 2021, and things have perhaps changed, so knowing about job limitations per user would be good to know about as well.)

As I understand it, this all looks good: iammedemo owns the directory, but iammme has default:user:iamme:rwx, so if anything, iamme should effectively be just as privileged as iammedemo, and be able to do anything in the directory:

[iamme@iamme-demo:~/IAMME]$ ls -last /tmp/badDir                                                  
total 28
 4 drwxr-xr-x+   2 iammedemo users  4096 Jun 22 00:50 .
24 drwxrwxrwt  220 iamme     users 20480 Jun 22 00:50 ..

[iamme@iamme-demo:~/IAMME]$ getfacl /tmp/badDir                                                   
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir
# owner: iammedemo
# group: users
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:iamme:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

But, I must be missing something:

[iamme@iamme-demo:~/IAMME]$ touch /tmp/badDir
touch: setting times of '/tmp/badDir': Permission denied                                       

[iamme@iamme-demo:~/IAMME]$ touch /tmp/badDir/foo                                                 
touch: cannot touch '/tmp/badDir/foo': Permission denied