UCF STIG Viewer Logo

Write or greater access to SYS1.IMAGELIB must be limited to system programmers only.


Overview

Finding ID Version Rule ID IA Controls Severity
V-111 ACP00040 SV-111r4_rule High
Description
SYS1.IMAGELIB is a partitioned data set containing universal character set (UCS), forms control buffer (FCB), and printer control information. Most IBM standard UCS images are included in SYS1.IMAGELIB during system installation. This data set should be protected as a z/OS system data set.
STIG Date
z/OS RACF STIG 2019-12-12

Details

Check Text ( C-807r3_chk )
Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(IMAGERPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection.

- PDI(ACP00040)

If the following guidance is true, this is not a finding.

___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access.

___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel.

___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
Fix Text (F-17036r2_fix)
The IAO must ensure that UPDATE and/or ALLOCATE access to SYS1.IMAGELIB is limited to system programmers only and all update and allocate access is logged.

Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB.

SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.