Title

z/OS UNIX resources must be protected in accordance with security requirements. (Cat I impact)

Discussion

z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.

Check Content

Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection: - TSSCMDS.RPT(WHOOSURR) - SENSITVE.RPT(WHOHSURR) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZUSS0022) Ensure that the following resources and/or generic equivalents are properly protected according to the requirements specified below for the SURROGAT resource class. If the following guidance is true, this is not a finding. ___ The TSS resources and/or generic equivalent for BPX. is owned or DEFPROT is specified for the resource class. ___ The TSS resource access authorizations restrict BPX.SRV.user to system software processes (e.g., web servers) that act as servers under z/OS UNIX.

Fix Text

The Systems Programmer and IAO will ensure that BPX. SRV.userid resources are properly protected and access is restricted to appropriate system tasks or systems programming personnel. SURROGAT class BPX resources are used in conjunction with server applications that are performing tasks on behalf of client users that may not supply an authenticator to the server. This can be the case when clients are otherwise validated or when the requested service is performed from userids representing groups. a) Ensure there is a TSS owner defined for the (BPX.) SURROGAT class resource. For Example: TSS ADD(dept) SURROGAT(BPX.) b) Ensure the TSS rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX. For Example: TSS PERMIT(<websrv>) SURROGAT(BPX.SRV.<webadm>) ACCESS(READ)

Additional Identifiers

Rule ID: SV-19747r4_rule

Vulnerability ID: V-6970

Group Title: ZUSS0022

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.