Write or greater access to SYS1.IMAGELIB must be limited to system programmers only.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-111	ACP00040	SV-111r3_rule	DCCS-1 DCCS-2 DCSL-1 ECAR-1 ECAR-2 ECAR-3	High

Description
SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.

STIG	Date
z/OS TSS STIG	2015-03-27

Details

Check Text ( C-807r2_chk )
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(IMAGERPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection. All of the following must be true, or this is a finding: - PDI(ACP00040) ___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access. ___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel. ___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.

Check Text ( C-807r2_chk )

Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(IMAGERPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection. All of the following must be true, or this is a finding:

- PDI(ACP00040)

___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access.

___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel.

___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.

Fix Text (F-17036r2_fix)
The IAO must ensure that UPDATE and/or ALLOCATE access to SYS1.IMAGELIB is limited to system programmers only and all update and allocate access is logged. Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB. SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.

Fix Text (F-17036r2_fix)

The IAO must ensure that UPDATE and/or ALLOCATE access to SYS1.IMAGELIB is limited to system programmers only and all update and allocate access is logged.

Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB.

SYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.