Navigate

Check: RACF-OS-000300

IBM z/OS RACF STIG: RACF-OS-000300 (in versions v8 r14 through v7 r1)

Title

IBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s). (Cat II impact)

Discussion

Failure to specify LINKAUTH=APFTAB allows libraries other than those designated as APF to contain authorized modules which could bypass security and violate the integrity of the operating system environment. This expanded authorization list inhibits the ability to control inclusion of these modules.

Check Content

Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. If LNKAUTH=APFTAB is not specified, this is a finding.

Fix Text

Configure LNKAUTH=APFTAB in the IEASYS00 member of PARMLIB.

Additional Identifiers

Rule ID: SV-223786r604139_rule

Vulnerability ID: V-223786

Group Title: SRG-OS-000095-GPOS-00049

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000381	The organization configures the information system to provide only essential capabilities.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
CM-7	Least Functionality