Ensure that access to all APF-authorized objects is controlled

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that FACILITY and OPERCMDS appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that FACILITY and OPERCMDS appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that FACILITY and OPERCMDS appears. Request the following DSMON report: FUNCTION SYSTEM RACGAC Verify that the DATASET entry has: -- GLOBAL INACTIVE -- or -- NO ENTRIES -- or contains no entries covering APF data sets Verify that ... (full steps: CIS section 2.2.7)

修正方法

修正方法: ガイダンスまたは IaC パッチ

To activate RACF classes use the RACF SETROPTS command: SETROPTS CLASSACT(FACILITY) SETROPTS CLASSACT(OPERCMDS) To enable generic profile checking for a RACF class use the RACF SETROPTS command: SETROPTS GENERIC(FACILITY) SETROPTS GENERIC(OPERCMDS) To RACLIST a RACF class use the RACF SETROPTS command: SETROPTS RACLIST(FACILITY) SETROPTS RACLIST(OPERCMDS) To create a DATASET profile use the RACF ADDSD and PERMIT commands: ADDSD '<profile>' GENERIC + UACC(NONE) + AUDIT(SUCCESS(UPDATE),FAILURES(READ)) + DATA('APF LIBRARY') PERMIT '<profile>' GENERIC + ACCESS(READ) ID(*) PERMIT '<profile>' GENERIC + ACCESS(ALTER) ID(SYSPROG) SETROPTS REFRESH GENERIC(DATASET) To create a FACILITY or OPERCMDS profile use the RACF RDEFINE, PERMIT, and SETROPTS commands: RDEFINE FACILITY BPX.FILEATTR.APF + UACC(NONE) + AUDIT(ALL(READ)) + DATA('ACCESS TO SET APF AUTHORIZATION ON UNIX FILE') PERMIT BPX.FILEATTR.APF CLASS(FACILITY) + ACCESS(READ) ID(SYSPROG) SETROPTS REFRESH RACLIST(FACILITY) RDEFINE OPERCMDS MVS.SETPROG + UACC(NONE) + AUDIT(SUCCESS(UPDATE),FAILURES(READ)) + DATA('SETPROG COMMAND') PERMIT MVS.SETPROG CLASS(OPERCMDS) + ACCESS(UPDATE) ID(SYSPROG) RDEFINE OPERCMDS ... (see CIS section 2.2.7)