Ensure that access to package-related tables is restricted

MédiaNível 1Revisão manualdb2-zos

Descrição

The following tables contain information related to packages, dependencies of packages on objects, and statements in the packages: SYSIBM.SYSPACKAGE SYSIBM.SYSPACKCOPY SYSIBM.SYSPACKDEP SYSIBM.SYSPACKLIST SYSIBM.SYSPACKSTMT SYSIBM.SYSPACKSTMT_STMB SYSIBM.SYSPACKSTMT_STMT PUBLIC should be restricted from accessing these tables.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

For Db2 internal security users: Issue the following SQL statement to check if PUBLIC has access: SELECT GRANTEE, TCREATOR, TTNAME FROM SYSIBM.SYSTABAUTH WHERE TCREATOR = 'SYSIBM' AND TTNAME LIKE 'SYSPACK%' AND GRANTEE = 'PUBLIC'; Output that contains zero rows is considered a successful finding. Otherwise, PUBLIC has SELECT privilege and the remediation steps should be followed. For external security users: Issue the RACF RLIST command to list the profiles that control access to the package- related tables in the MDSNTB class. Examine the universal access ... (full steps: CIS section 2.2.12)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

For Db2 internal security users: Issue the SQL REVOKE statement to revoke access from PUBLIC: For external security users: Issue the RACF RALTER command to update the profiles and change the UACC setting to NONE. Issue the RACF PERMIT command to remove the ID(*) and specify users or groups.

Propriedades

Sistemas operacionais: Qualquer
Tags: db2-zospermissions
Referência: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 2.2.12 Ensure that access to package-related tables is restricted