IBM RACF must limit Write or greater access to libraries that contain PPT modules to system programmers only.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223650	RACF-ES-000020	SV-223650r853568_rule		Low

Description
Specific PPT designated program modules possess significant security bypass capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2024-02-22

Details

Check Text ( C-25323r514639_chk )
Review program entries in the IBM Program Properties Table (PPT). You may use a third-party product to examine these entries however, to determine program entries issue the following command from an ISPF command line: TSO ISRDDN LOAD IEFSDPPT Press Enter. For each module identified in the "eyecatcher" if all of the following are untrue, this is not a finding. If any of the following is true, this is a finding. -The ACP data set rules for libraries that contain PPT modules do not restrict WRITE or greater access to only z/OS systems programming personnel. -The ACP data set rules for libraries that contain PPT modules do not specify that all WRITE or greater access will be logged.

Check Text ( C-25323r514639_chk )

Review program entries in the IBM Program Properties Table (PPT). You may use a third-party product to examine these entries however, to determine program entries issue the following command from an ISPF command line:
TSO ISRDDN LOAD IEFSDPPT
Press Enter.

For each module identified in the "eyecatcher" if all of the following are untrue, this is not a finding.

If any of the following is true, this is a finding.

-The ACP data set rules for libraries that contain PPT modules do not restrict WRITE or greater access to only z/OS systems programming personnel.
-The ACP data set rules for libraries that contain PPT modules do not specify that all WRITE or greater access will be logged.

Fix Text (F-25311r514640_fix)
Configure the WRITE or greater access to libraries containing PPT modules to be limited to system programmers only and all WRITE or greater access is logged.