BPX resource(s) is(are) not protected in accordance with security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6968	ZUSS0021	SV-7405r2_rule		Medium

Description
z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.

STIG	Date
z/OS TSS STIG	2017-06-26

Details

Check Text ( C-20873r1_chk )
a) Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection: - TSSCMDS.RPT(WHOOIBMF) - SENSITVE.RPT(WHOHIBMF) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZUSS0021) b) Review the following items for the IBMFAC resource class: 1) The TSS owner defined for the BPX resource. 2) There are no TSS rules that allow access to the BPX resource. 3) There are no TSS rules for BPX.SAFFASTPATH defined. 4) The TSS rules for each of the BPX resources listed in the General Facility Class BPX Resources Table in the z/OS STIG Addendum, restrict access to appropriate system tasks or systems programming personnel. c) If any item in (b) is untrue, this is a FINDING. d) If all items in (b) are true, this is NOT A FINDING.

Check Text ( C-20873r1_chk )

a) Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection:

- TSSCMDS.RPT(WHOOIBMF)
- SENSITVE.RPT(WHOHIBMF)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ZUSS0021)

b) Review the following items for the IBMFAC resource class:

1) The TSS owner defined for the BPX resource.
2) There are no TSS rules that allow access to the BPX resource.
3) There are no TSS rules for BPX.SAFFASTPATH defined.
4) The TSS rules for each of the BPX resources listed in the General Facility Class BPX Resources Table in the z/OS STIG Addendum, restrict access to appropriate system tasks or systems programming personnel.

c) If any item in (b) is untrue, this is a FINDING.

d) If all items in (b) are true, this is NOT A FINDING.

Fix Text (F-18829r1_fix)
Because they convey especially powerful privileges, the settings for BPX.DAEMON, BPX.SAFFASTPATH, BPX.SERVER, and BPX.SUPERUSER require special attention. Review the following items for the IBMFAC resource class: 1) The TSS owner defined for the BPX resource. 2) There are no TSS rules that allow access to the BPX resource. 3) There is no TSS rules for BPX.SAFFASTPATH defined. 4) The TSS rules for each of the BPX resources listed in General Facility Class BPX Resources Table, in the zOS STIG Addendum restrict access to appropriate system tasks or systems programming personnel. Access can be permitted only to users with a requirement for the resource that is documented to the IAO. Access to BPX.DAEMON must be restricted to the z/OS UNIX kernel userid, z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons (e.g., web servers). when BPX.SAFFASTPATH is defined, calls to the ACP are not performed for file accesses and there is no audit trail of access failures. This configuration is unacceptable. Therefore BPX.SAFFASTPATH must not be used on any system. For Example: The following commands can be used to provide the required protection: TSS ADD(ADMIN) IBMFAC(BPX.) TSS PERMIT(ALL) IBMFAC(BPX.SAFFASTPATH) ACCESS(NONE) NOTE: The PERMIT command for BPX.SAFFASTPATH must be executed on TOP SECRET systems. If access to BPX.SAFFSTPATH were allowed, z/OS UNIX would perform permission bit checking internally instead of calling the ACP. On TOP SECRET systems this would bypass any audit trail of violations. In addition, the z/OS UNIX kernel userid (OMVS is the example in this section) must not have the TOP SECRET NORESCHK privilege. Having that privilege would allow access to BPX.SAFFASTPATH even though the access restriction was in place.

Fix Text (F-18829r1_fix)

Because they convey especially powerful privileges, the settings for BPX.DAEMON, BPX.SAFFASTPATH, BPX.SERVER, and BPX.SUPERUSER require special attention.

Review the following items for the IBMFAC resource class:

1) The TSS owner defined for the BPX resource.

2) There are no TSS rules that allow access to the BPX resource.

3) There is no TSS rules for BPX.SAFFASTPATH defined.

4) The TSS rules for each of the BPX resources listed in General Facility Class BPX Resources Table, in the zOS STIG Addendum restrict access to appropriate system tasks or systems programming personnel. Access can be permitted only to users with a requirement for the resource that is documented to the IAO. Access to BPX.DAEMON must be restricted to the z/OS UNIX kernel userid, z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons (e.g., web servers). when BPX.SAFFASTPATH is defined, calls to the ACP are not performed for file accesses and there is no audit trail of access failures. This configuration is unacceptable. Therefore BPX.SAFFASTPATH must not be used on any system.

For Example:
The following commands can be used to provide the required protection:

TSS ADD(ADMIN) IBMFAC(BPX.)
TSS PERMIT(ALL) IBMFAC(BPX.SAFFASTPATH) ACCESS(NONE)

NOTE:
The PERMIT command for BPX.SAFFASTPATH must be executed on TOP SECRET systems. If access to BPX.SAFFSTPATH were allowed, z/OS UNIX would perform permission bit checking internally instead of calling the ACP. On TOP SECRET systems this would bypass any audit trail of violations. In addition, the z/OS UNIX kernel userid (OMVS is the example in this section) must not have the TOP SECRET NORESCHK privilege. Having that privilege would allow access to BPX.SAFFASTPATH even though the access restriction was in place.