IBM RACF started tasks defined with the trusted attribute must be justified.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223661	RACF-ES-000130	SV-223661r604139_rule		Medium

Description
Trusted Started tasks bypass RACF checking. It is vital that this attribute is NOT granted to unauthorized Started Tasks which could then obtain unauthorized access to the system. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, or customer data.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2023-12-27

Details

Check Text ( C-25334r514672_chk )
Refer to the list of z/OS started tasks and address spaces in the IBM z/OS MVS Initialization and Tuning Reference. If the only approved Started Tasks that have the TRUSTED flag enabled are in this list, this is not a finding. If there are no Started Tasks that have been granted the PRIVILEGED attribute, this is not a finding. Guidelines for reference: Assign the TRUSTED attribute when one of the following conditions applies: - The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation. - Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem. Avoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation. Additionally external security managers are candidates for trusted attribute. Any other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official.

Check Text ( C-25334r514672_chk )

Refer to the list of z/OS started tasks and address spaces in the IBM z/OS MVS Initialization and Tuning Reference.

If the only approved Started Tasks that have the TRUSTED flag enabled are in this list, this is not a finding.

If there are no Started Tasks that have been granted the PRIVILEGED attribute, this is not a finding.

Guidelines for reference:

Assign the TRUSTED attribute when one of the following conditions applies:
- The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation.
- Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem.
Avoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation.

Additionally external security managers are candidates for trusted attribute.
Any other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official.

Fix Text (F-25322r514673_fix)
Review assignment of the TRUSTED attribute in ICHRIN03 and/or the STARTED resource class. Ensure only those trusted STCs that are listed in the IBM z/OS MVS Initialization and Tuning Reference have been granted this authority. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes. While the actual list may vary based on local site requirements and software configuration, the started tasks listed in the IBM z/OS MVS Initialization and Tuning Reference is an approved list of started tasks that may be considered trusted started procedures. Guidelines for reference: Assign the TRUSTED attribute when one of the following conditions applies: -The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation. -Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem. -Avoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation. Additionally external security managers are candidates for trusted attribute. Any other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official. The TRUSTED attribute can be removed from a STARTED class profile using the command: RALT STARTED STDATA(TRUSTED(NO)) If the STARTED class is RACLISTed then a refresh command is necessary: SETR RACL(STARTED) REFRESH If any Started Tasks exist with the PRIVILEGED attribute then take the following action to remove this attribute: RALT STARTED STDATA(PRIVILEGED(NO)) If the STARTED class is RACLISTed then a refresh command is necessary: SETR RACL(STARTED) REFRESH

Fix Text (F-25322r514673_fix)

Review assignment of the TRUSTED attribute in ICHRIN03 and/or the STARTED resource class. Ensure only those trusted STCs that are listed in the IBM z/OS MVS Initialization and Tuning Reference have been granted this authority. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes. While the actual list may vary based on local site requirements and software configuration, the started tasks listed in the IBM z/OS MVS Initialization and Tuning Reference is an approved list of started tasks that may be considered trusted started procedures. Guidelines for reference:

Assign the TRUSTED attribute when one of the following conditions applies:
-The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation.
-Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem.
-Avoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation.

Additionally external security managers are candidates for trusted attribute. Any other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official.

The TRUSTED attribute can be removed from a STARTED class profile using the command:
RALT STARTED STDATA(TRUSTED(NO))

If the STARTED class is RACLISTed then a refresh command is necessary:
SETR RACL(STARTED) REFRESH

If any Started Tasks exist with the PRIVILEGED attribute then take the following action to remove this attribute:
RALT STARTED STDATA(PRIVILEGED(NO))

If the STARTED class is RACLISTed then a refresh command is necessary:
SETR RACL(STARTED) REFRESH