System queue security

You must set up RACF® access to allow certain user IDs access to particular system queues.

Many of the system queues are accessed by the ancillary parts of IBM MQ :

  • The CSQUTIL utility
  • The operations and control panels
  • The channel initiator address space (including the Queued Pub/Sub Daemon)
  • The mqweb Liberty server, used by the MQ Console and REST API (mqweb server).

The user IDs under which these run must be given RACF access to these queues, as shown in Table 1.

Table 1. Access required to the SYSTEM queues by IBM MQ
SYSTEM queue CSQUTIL CSQ0UTIL WLP for MQ Server Operations and control panels Channel initiator for distributed queuing
SYSTEM.ADMIN.CHANNEL.EVENT - - - - UPDATE
SYSTEM.ADMIN.COMMAND.QUEUE - - UPDATE - -
SYSTEM.BROKER.ADMIN.STREAM - - - - ALTER
SYSTEM.BROKER.CONTROL.QUEUE - - - - ALTER
SYSTEM.BROKER.DEFAULT.STREAM - - - - ALTER
SYSTEM.BROKER.INTER.BROKER.COMMUNICATIONS - - - - UPDATE
SYSTEM.CHANNEL.INITQ - - - - UPDATE
SYSTEM.CHANNEL.SYNCQ - - - - UPDATE
SYSTEM.CLUSTER.COMMAND.QUEUE - - - - ALTER
SYSTEM.CLUSTER.REPOSITORY.QUEUE - - - - UPDATE
SYSTEM.CLUSTER.TRANSMIT.QUEUE - - - - ALTER
SYSTEM.COMMAND.INPUT UPDATE - - UPDATE UPDATE
SYSTEM.COMMAND.REPLY.* - - - - UPDATE
SYSTEM.COMMAND.REPLY.MODEL UPDATE - - UPDATE UPDATE
SYSTEM.CSQOREXX.* - - - UPDATE -
SYSTEM.CSQUTIL.* UPDATE - - - -
SYSTEM.CSQXCMD.* - - - - UPDATE
SYSTEM.HIERARCHY.STATE - - - - UPDATE
SYSTEM.INTER.QMGR.CONTROL - - - - UPDATE
SYSTEM.INTER.QMGR.PUBS - - - - UPDATE
SYSTEM.INTER.QMGR.FANREQ - - - - UPDATE
SYSTEM.PROTECTION.ERROR.QUEUE - - - - UPDATE
SYSTEM.PROTECTION.POLICY.QUEUE - UPDATE(1) - - READ
SYSTEM.QSG.CHANNEL.SYNCQ - - - - UPDATE
SYSTEM.QSG.TRANSMIT - - - - UPDATE
SYSTEM.REST.REPLY.QUEUE - - UPDATE - -