Write or greater access to SYS1.IMAGELIB must be limited to system programmers only.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-111	ACP00040	SV-111r4_rule	DCCS-1 DCCS-2 DCSL-1 ECAR-1 ECAR-2 ECAR-3	High

Description
SYS1.IMAGELIB is a partitioned data set containing universal character set (UCS), forms control buffer (FCB), and printer control information. Most IBM standard UCS images are included in SYS1.IMAGELIB during system installation. This data set should be protected as a z/OS system data set.

STIG	Date
z/OS RACF STIG	2016-01-04

Details

Check Text ( C-807r3_chk )
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(IMAGERPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection. - PDI(ACP00040) If the following guidance is true, this is not a finding. ___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access. ___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel. ___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.

Check Text ( C-807r3_chk )

Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(IMAGERPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection.

- PDI(ACP00040)

If the following guidance is true, this is not a finding.

___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access.

___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel.

___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.

Fix Text (F-17036r2_fix)
The IAO must ensure that UPDATE and/or ALLOCATE access to SYS1.IMAGELIB is limited to system programmers only and all update and allocate access is logged. Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB. SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.

Fix Text (F-17036r2_fix)

The IAO must ensure that UPDATE and/or ALLOCATE access to SYS1.IMAGELIB is limited to system programmers only and all update and allocate access is logged.

Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB.

SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.