Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The IBM RACF classes required to properly secure the z/OS UNIX environment must be ACTIVE.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-223850 | RACF-US-000130 | SV-223850r853640_rule | Medium |
| Description |
|---|
| In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations. |
| STIG | Date |
|---|---|
| IBM z/OS RACF Security Technical Implementation Guide | 2023-12-27 |
Details
| Check Text ( C-25523r515238_chk ) |
|---|
| From the ISPF Command Shell enter: SETRopts list If the ACTIVE CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, this is not a finding. If either of the above resource classes is missing, this is a finding. |
| Fix Text (F-25511r515239_fix) |
|---|
| Define the ACTIVE CLASS Parameter in SETROPTS to include the FACILITY, SURROGAT and UNIXPRIV resource classes. EXAMPLES: SETR CLASSACT(FACILITY SURROGAT UNIXPRIV) SETR GENERIC(FACILITY SURROGAT UNIXPRIV) SETR GENCMD(FACILITY SURROGAT UNIXPRIV) SETR RACL(FACILITY SURROGAT UNIXPRIV) |