z/OS UNIX resources must be protected in accordance with security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6970	ZUSS0022	SV-19747r4_rule		High

Description
z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.

STIG	Date
z/OS TSS STIG	2019-12-12

Details

Check Text ( C-18026r3_chk )
Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection: - TSSCMDS.RPT(WHOOSURR) - SENSITVE.RPT(WHOHSURR) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZUSS0022) Ensure that the following resources and/or generic equivalents are properly protected according to the requirements specified below for the SURROGAT resource class. If the following guidance is true, this is not a finding. ___ The TSS resources and/or generic equivalent for BPX. is owned or DEFPROT is specified for the resource class. ___ The TSS resource access authorizations restrict BPX.SRV.user to system software processes (e.g., web servers) that act as servers under z/OS UNIX.

Check Text ( C-18026r3_chk )

Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection:

- TSSCMDS.RPT(WHOOSURR)
- SENSITVE.RPT(WHOHSURR)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ZUSS0022)

Ensure that the following resources and/or generic equivalents are properly protected according to the requirements specified below for the SURROGAT resource class. If the following guidance is true, this is not a finding.

___ The TSS resources and/or generic equivalent for BPX. is owned or DEFPROT is specified for the resource class.

___ The TSS resource access authorizations restrict BPX.SRV.user to system software processes (e.g., web servers) that act as servers under z/OS UNIX.

Fix Text (F-19191r1_fix)
The Systems Programmer and IAO will ensure that BPX. SRV.userid resources are properly protected and access is restricted to appropriate system tasks or systems programming personnel. SURROGAT class BPX resources are used in conjunction with server applications that are performing tasks on behalf of client users that may not supply an authenticator to the server. This can be the case when clients are otherwise validated or when the requested service is performed from userids representing groups. a) Ensure there is a TSS owner defined for the (BPX.) SURROGAT class resource. For Example: TSS ADD(dept) SURROGAT(BPX.) b) Ensure the TSS rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX. For Example: TSS PERMIT() SURROGAT(BPX.SRV.) ACCESS(READ)

Fix Text (F-19191r1_fix)

The Systems Programmer and IAO will ensure that BPX. SRV.userid resources are properly protected and access is restricted to appropriate system tasks or systems programming personnel.

SURROGAT class BPX resources are used in conjunction with server applications that are performing tasks on behalf of client users that may not supply an authenticator to the server. This can be the case when clients are otherwise validated or when the requested service is performed from userids representing groups.

a) Ensure there is a TSS owner defined for the (BPX.) SURROGAT class resource.
For Example:
TSS ADD(dept) SURROGAT(BPX.)

b) Ensure the TSS rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX.

For Example:
TSS PERMIT() SURROGAT(BPX.SRV.)
ACCESS(READ)