← Back to IBM z/OS RACF Security Technical Implementation Guide

V-223850

CAT II (Medium)

The IBM RACF classes required to properly secure the z/OS UNIX environment must be ACTIVE.

Rule ID

SV-223850r958730_rule

STIG

IBM z/OS RACF Security Technical Implementation Guide

Version

V9R8

CCIs

CCI-002233

Discussion

In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations.

Check Content

From the ISPF Command Shell enter:
SETRopts list

If the ACTIVE CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, this is not a finding.

If either of the above resource classes is missing, this is a finding.

Fix Text

Define the ACTIVE CLASS Parameter in SETROPTS to include the FACILITY, SURROGAT and UNIXPRIV resource classes.

EXAMPLES:
SETR CLASSACT(FACILITY SURROGAT UNIXPRIV) 

SETR GENERIC(FACILITY SURROGAT UNIXPRIV)
SETR GENCMD(FACILITY SURROGAT UNIXPRIV)

SETR RACL(FACILITY SURROGAT UNIXPRIV)