STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

IBM z/OS BPX resource(s) must be protected in accordance with security requirements.

DISA Rule

SV-223621r533198_rule

Vulnerability Number

V-223621

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

ACF2-US-000060

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure BPX. Resources to be properly protected and access is restricted to appropriate system tasks or systems programming personnel.

Configure the following items for the FACILITY resource class, TYPE(FAC):

The ACF2 rules for the BPX resource specify a default access of NONE.

Example:
$KEY(BPX) TYPE(FAC)
- UID(*) PREVENT

There are no ACF2 rules that allow access to the BPX resource.

Example:
$KEY(BPX) TYPE(FAC)
- UID(*) PREVENT

There is no ACF2 rule for BPX.SAFFASTPATH defined.

Example:
$KEY(BPX) TYPE(FAC)
SAFFASTPATH UID(*) PREVENT

The ACF2 rules for each of the BPX resources listed in the General Facility Class BPX Resources Table, in the z/OS UNIX System Services Planning, Establishing UNIX security, specify a default access of NONE.

Example:
$KEY(BPX) TYPE(FAC)
DAEMON UID(*) PREVENT
DEBUG UID(*) PREVENT
FILEATTR.APF UID(*) PREVENT
FILEATTR.PROGCTL UID(*) PREVENT
JOBNAME UID(*) PREVENT
SAFFASTPATH UID(*) PREVENT
SERVER UID(*) PREVENT
SMF UID(*) PREVENT
STOR.SWAP UID(*) PREVENT
SUPERUSER UID(*) PREVENT
WLMSERVER UID(*) PREVENT

The ACF2 rules for each of the BPX resources listed in the General Facility Class BPX Resources Table, in the z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel as specified.

Example:
$KEY(BPX) TYPE(FAC)
DAEMON UID(*******STC******FTPD) SERVICE(READ) LOG
DAEMON UID(*******STC******INETD) SERVICE(READ) LOG
DAEMON UID(*******STC******NAMED) SERVICE(READ) LOG
DAEMON UID(*******STC******OMVSKERN) SERVICE(READ) LOG
DAEMON UID(*******STC******OMVS) SERVICE(READ) LOG
DAEMON UID(*******STC******OROUTED) SERVICE(READ) LOG
DAEMON UID(*******STC******OSNMPD) SERVICE(READ) LOG

Check Contents

From the ISPF Command Shell enter:
ACF
SET RESOURCE(FAC)
SET VERBOSE
LIST LIKE(BPX-)

If the ACF2 rules for the BPX resource specify a default access of NONE, this is not a finding.

If there are no ACF2 rules that allow access to the BPX resource, this is not a finding.

If there is no ACF2 rule for BPX.SAFFASTPATH defined, this is not a finding.

If the ACF2 rules for each of the BPX resources listed in z/OS UNIX System Services Planning, Establishing UNIX security, specify a default access of NONE, this is not a finding.

If the ACF2 rules for each of the BPX resources listed in the in z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel, this is not a finding.

Vulnerability Number

V-223621

Documentable

False

Rule Version

ACF2-US-000060

Severity Override Guidance

From the ISPF Command Shell enter:
ACF
SET RESOURCE(FAC)
SET VERBOSE
LIST LIKE(BPX-)

If the ACF2 rules for the BPX resource specify a default access of NONE, this is not a finding.

If there are no ACF2 rules that allow access to the BPX resource, this is not a finding.

If there is no ACF2 rule for BPX.SAFFASTPATH defined, this is not a finding.

If the ACF2 rules for each of the BPX resources listed in z/OS UNIX System Services Planning, Establishing UNIX security, specify a default access of NONE, this is not a finding.

If the ACF2 rules for each of the BPX resources listed in the in z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel, this is not a finding.

Check Content Reference

M

Target Key

4100

Comments