Access to SYS(x).TRACE is not limited to system programmers only.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-127	ACP00220	SV-127r2_rule	DCCS-1 DCCS-2 ECCD-1 ECCD-2	Medium

Description
SYS1.TRACE is used to trace and debug system problems. Unauthorized access could result in a compromise of the integrity and availability of all system data and processes.

STIG	Date
z/OS RACF STIG	2017-03-22

Details

Check Text ( C-5028r1_chk )
a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(TRACERPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00220) ___ The ACP data set rule for SYS1.TRACE allows inappropriate access. ___ The ACP data set rule for SYS1.TRACE does not restrict access to systems programming personnel and started tasks that perform GTF processing. b) If both of the above are untrue, there is NO FINDING. c) If either of the above is true, this is a FINDING.

Check Text ( C-5028r1_chk )

a) Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(TRACERPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ACP00220)

___ The ACP data set rule for SYS1.TRACE allows inappropriate access.

___ The ACP data set rule for SYS1.TRACE does not restrict access to systems programming personnel and started tasks that perform GTF processing.

b) If both of the above are untrue, there is NO FINDING.

c) If either of the above is true, this is a FINDING.

Fix Text (F-17417r1_fix)
The IAO will ensure that access to SYS1.TRACE is limited to system programmers only.