Inapplicable PPT entries have not been invalidated.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90	AAMV0160	SV-90r2_rule	DCCS-1 DCCS-2	Medium

Description
If invalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities.

STIG	Date
z/OS RACF STIG	2019-12-12

Details

Check Text ( C-20009r1_chk )
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PPTXRPT) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0160) b) Review the program entries in the CA-EXAMINE PPT LIBRARY SEARCH report. For all programs not found on the operating system (i.e., missing link date, size, volume, and library name), review their corresponding entries in the CA-EXAMINE PROGRAM PROPERTIES TABLE ANALYSIS report. If a program entry is found with any of the following excessive privileges, ensure that a matching SCHEDxx entry exists for that program revoking these privileges: 1) Data set integrity bypass 2) Keys 0-7 3) Security bypass c) If a SCHEDxx entry exists for all applicable PPT programs revoking the excessive privileges above, there is NO FINDING. d) If a SCHEDxx entry does not exist for an applicable PPT program, or does not revoke all the excessive privileges above, this is a FINDING. Note: Modules for products not in use on the system will have their special privileges explicitly revoked.

Check Text ( C-20009r1_chk )

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PPTXRPT)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(AAMV0160)

b) Review the program entries in the CA-EXAMINE PPT LIBRARY SEARCH report. For all programs not found on the operating system (i.e., missing link date, size, volume, and library name), review their corresponding entries in the CA-EXAMINE PROGRAM PROPERTIES TABLE ANALYSIS report. If a program entry is found with any of the following excessive privileges, ensure that a matching SCHEDxx entry exists for that program revoking these privileges:

1) Data set integrity bypass
2) Keys 0-7
3) Security bypass

c) If a SCHEDxx entry exists for all applicable PPT programs revoking the excessive privileges above, there is NO FINDING.

d) If a SCHEDxx entry does not exist for an applicable PPT program, or does not revoke all the excessive privileges above, this is a FINDING.

Note: Modules for products not in use on the system will have their special privileges explicitly revoked.

Fix Text (F-16968r1_fix)
The systems programmer will ensure that any invalid entries in the PPT via IEFSDPPT module or invalid entries in the SCHED PPT are nullified by (a) nullifying the invalid IEFSDPPT entry ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) removing the SCHED PPT entry which is no longer valid if it only exists in this member. Review the PPT and ensure that all entries associated with non-existent or inapplicable modules are invalidated. As applicable, either: (a) nullify the invalid IEFSDPPT entry by ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) remove the SCHED PPT entry which is no longer valid. Some programs require extraordinary privileges not normally permitted by the operating system. The Program Properties Table (PPT) contains the names and properties of these special programs. Programs in the PPT can bypass security software mechanisms such as password protection. Only programs that require special authorizations are coded in the PPT. The PPT is maintained differently depending upon the level of MVS. Use the following recommendations and techniques to provide protection for the PPT: (1) As part of standard MVS maintenance, systems programming personnel will review the IEFSDPPT module and all programs that IBM has, by default, placed in the PPT to validate their applicability to the execution system. Please refer to the IBM z/OS MVS Initialization and Tuning Reference documentation for the version and release of z/OS installed at the individual site for the actual contents of the default IEFSDPPT (2) Modules for products not in use on the system will have their special privileges explicitly revoked. Do this by placing a PPT entry for each module in the SYS1.PARMLIB(SCHEDxx) member, specifying no special privileges. The PPT entry for each overridden program will be in the following format, accepting the default (unprivileged) values for the sub parameters: PPT PGMNAME() (3) The Software Support team will assemble documentation regarding these PPT entries, and the IAO will keep it on file. Include the following in the documentation: - The product and release for which the PPT entry was made - The last date this entry was reviewed to authenticate status - The reason the module's privileges are being revoked

Fix Text (F-16968r1_fix)

The systems programmer will ensure that any invalid entries in the PPT via IEFSDPPT module or invalid entries in the SCHED PPT are nullified by (a) nullifying the invalid IEFSDPPT entry ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) removing the SCHED PPT entry which is no longer valid if it only exists in this member.

Review the PPT and ensure that all entries associated with non-existent or inapplicable modules are invalidated. As applicable, either: (a) nullify the invalid IEFSDPPT entry by ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) remove the SCHED PPT entry which is no longer valid.

Some programs require extraordinary privileges not normally permitted by the operating system. The Program Properties Table (PPT) contains the names and properties of these special programs. Programs in the PPT can bypass security software mechanisms such as password protection. Only programs that require special authorizations are coded in the PPT.

The PPT is maintained differently depending upon the level of MVS. Use the following recommendations and techniques to provide protection for the PPT:

(1) As part of standard MVS maintenance, systems programming personnel will review the IEFSDPPT module and all programs that IBM has, by default, placed in the PPT to validate their applicability to the execution system. Please refer to the IBM z/OS MVS Initialization and Tuning Reference documentation for the version and release of z/OS installed at the individual site for the actual contents of the default IEFSDPPT

(2) Modules for products not in use on the system will have their special privileges explicitly revoked. Do this by placing a PPT entry for each module in the SYS1.PARMLIB(SCHEDxx) member, specifying no special privileges. The PPT entry for each overridden program will be in the following format, accepting the default (unprivileged) values for the sub parameters:

PPT PGMNAME()

(3) The Software Support team will assemble documentation regarding these PPT entries, and the IAO will keep it on file. Include the following in the documentation:

- The product and release for which the PPT entry was made
- The last date this entry was reviewed to authenticate status
- The reason the module's privileges are being revoked