IBM z/OS Started Tasks must be properly identified to RACF.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-98145	RACF-ES-000720	SV-107249r1_rule		Medium

Description
Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2020-06-29

Details

Check Text ( C-96981r1_chk )
Ask the system administrator for a list of stated tasks available on the system. If each Started task procedures identified has a unique associated userid or STC userids that is unique per product and function, this is not a finding.

Fix Text (F-103821r1_fix)
Define a RACF STARTED Class profile for each Started Proc that maps the proc to a unique userid, or STC userids will be unique per product and function if supported by vendor documentation. This can be accomplished with the sample command: RDEF STARTED .** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER() GROUP() TRACE(YES)) A corresponding USERID must be defined with appropriate authority. The "groupname" should be a valid STC group with no interactive users.

Fix Text (F-103821r1_fix)

Define a RACF STARTED Class profile for each Started Proc that maps the proc to a unique userid, or STC userids will be unique per product and function if supported by vendor documentation. This can be accomplished with the sample command:
RDEF STARTED .** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER() GROUP() TRACE(YES))

A corresponding USERID must be defined with appropriate authority. The "groupname" should be a valid STC group with no interactive users.