Ensure that started tasks defined with the PRIVILEGED attribute is justified

高レベル 1手動レビューibm-z

説明

Some started tasks require access to a broad set of resources, making it impractical to permit the started task to each of these resources individually. In these cases, the security administrator can choose between assigning the TRUSTED attribute and the PRIVILEGED attribute. A lack of logging can result in loss of visibility as to what protected resources a started task is accessing.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that STARTED appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that STARTED appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that STARTED appears. Request the following DSMON report: FUNCTION SYSTEM RACSPT Review the report and for any profiles that have YES in the PRIVILEGED column: Verify that the PRIVILEGED attribute assignment is justified. Note: Examples of PRIVILEGED ... (full steps: CIS section 2.4.5)

修正方法

修正方法: ガイダンスまたは IaC パッチ

To activate RACF classes use the RACF SETROPTS command: SETROPTS CLASSACT(STARTED) To enable generic profile checking for a RACF class use the RACF SETROPTS command: SETROPTS GENERIC(STARTED) To RACLIST a RACF class use the RACF SETROPTS command: SETROPTS RACLIST(STARTED) To replace PRIVILEGED with TRUSTED on a STARTED profile use the RACF RALTER and SETROPTS commands: RALTER STARTED <profile> + STDATA(TRUSTED) SETROPTS REFRESH RACLIST(STARTED)

プロパティ

オペレーティングシステム: すべて
タグ: ibm-zhardening
参照: CIS IBM z/OS with RACF Benchmark v1.0.0 - 2.4.5 Ensure that started tasks defined with the PRIVILEGED attribute is justified