Navigate

Check: ACF2-OS-000290

IBM z/OS ACF2 STIG: ACF2-OS-000290 (in versions v9 r2 through v7 r1)

Title

IBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s). (Cat II impact)

Discussion

Failure to specify LINKAUTH=APFTAB allows libraries other than those designated as APF to contain authorized modules which could bypass security and violate the integrity of the operating system environment. This expanded authorization list inhibits the ability to control inclusion of these modules.

Check Content

Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. If LNKAUTH=APFTAB is not specified, this is a finding.

Fix Text

Configure LNKAUTH=APFTAB in the IEASYS00 member of PARMLIB.

Additional Identifiers

Rule ID: SV-223565r958478_rule

Vulnerability ID: V-223565

Group Title: SRG-OS-000095-GPOS-00049

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000381	Configure the system to provide only organization-defined mission essential capabilities.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
CM-7	Least Functionality