Base SAS® 9.4_M6 and later releases require the PROTOLIBS system option to access external modules


Base SAS 9.4_M6 and later releases contain enhanced security to access external modules. It is no longer sufficient to use only the LINK statement in a PROTO step to register the load module that contains your external functions. In Base SAS 9.4_M6 and later releases, you must also use the PROTOLIBS system option to specify the paths that PROC PROTO can use to find and register load modules.

The PROTOLIBS system option is a restricted option that enables the SAS site administrator to govern which external modules a SAS session can access. For more details about usage of the PROTOLIBS system option, see the following documentation that is introduced in the section What's New in Application Server Administration for the SAS 9.4 Intelligence Platform:

SAS® 9.4 Intelligence Platform: Security Administration Guide, Third Edition
PROTOLIBS System Option
https://go.documentation.sas.com/?docsetId=bisecag&docsetTarget=n06aalnz518ebjn16cmn2bdlud3u.htm&docsetVersion=9.4&locale=en

The following are common messages that occur in the SAS log when you run SAS code that does not properly use the PROTOLIBS system option.

1) If you call a function that is contained in a load module that is defined by the LINK statement, and if you have not used the PROTOLIBS option to set the path to the load module, then the following error occurs. For example, you are likely to encounter this message if you do nothing after you upgrade to Base SAS 9.4_M6 and then run SAS code that references an external module.

ERROR: External modules that are defined with the PROC PROTO LINK statement have
been disabled by the option "PROTOLIBS=NONE".

2) If the SAS site administrator has specified the PROTOLIBS system option, but if the option does not include the path to the load module that is defined by the LINK statement, then a message like the following occurs for the path that is defined by the LINK statement:

ERROR: The path to the load module '<path-defined-by-LINK-statement>'
is not a valid path. Valid paths are specified in the PROTOLIBS option and
LOCKDOWN statement.

3) If you attempt to set the PROTOLIBS system option in a SAS session, then the following message occurs:

WARNING 30-12: SAS option PROTOLIBS is valid only at startup of the SAS System.
The SAS option is ignored.

4) If you start a SAS session by running an invocation command that sets the PROTOLIBS system option, and if you attempt to access a function that is contained in a load module that is defined by the LINK statement, then the following message occurs:

ERROR: You do not have authorization to set the value of the PROTOLIBS option.
Contact your SAS administrator about setting the value of the option.

For details about how to properly specify the PROTOLIBS system option, see the documentation that is referenced above.