The zSecure programs CKFCOLL and CKGRACF, and the APF-authorized version of program CKRCARLA, must be restricted to security administrators, security batch jobs performing External Security Manager (ESM) maintenance, auditors, and systems programmers, and audited.

An XCCDF Rule

Description

<VulnDiscussion>Users authorized to use the zSecure program CKFCOLL can collect z/OS system information that is not accessible to regular users. Users authorized to use the zSecure program CKGRACF can change certain permitted RACF profile definitions that otherwise would not be allowed. Users authorized to use the zSecure program CKRCARLX can fake SMF records. Allowing inappropriate users to use the CKFCOLL, CKGRACF, and CKRCARLX programs could result in disclosure of z/OS installation and configuration information or inappropriate RACF profile or SMF record changes. Satisfies: SRG-APP-000342-MFP-000090,SRG-APP-000343-MFP-000091</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-259734r943255_rule
Severity: Medium
References: CCI-002233 CCI-002234
Updated: 19 days ago

If this is not a RACF system, the presence of CKGRACF is not applicable.

Ensure READ access to zSecure functional resources is restricted to the appropriate staff members.

READ access can be given to auditors, security administrators (domain level and decentralized), security batch jobs that perform ESM maintenance, and trusted STC users.
The following commands are provided as a sample for implementing zSecure functional resource controls:

rdef xfacilit resource_profile_protecting_zSecure_CKF_ resource  uacc(none) owner(zSecure owner) 
pe resource_profile_protecting_zSecure_CKF_ resource class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)

rdef xfacilit CKG.CMD.**  uacc(none) owner(zSecure owner) 
pe CKG.CMD.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKG.RAC.**  uacc(none) owner(zSecure owner) 
pe CKG.RAC.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKG.SCHEDULE.**  uacc(none) owner(zSecure owner) 
pe CKG.SCHEDULE.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKG.SCP.**  uacc(none) owner(zSecure owner) 
pe CKG.SCP.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKG.UCAT.**  uacc(none) owner(zSecure owner) 
pe CKG.UCAT.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKG.USRDATA.**  uacc(none) owner(zSecure owner) 
pe CKG.USRDATA.** class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKNADMIN.TONODE.<node-name>  uacc(none) owner(zSecure owner) 
pe CKNADMIN.TONODE.<node-name>  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)

rdef xfacilit CKNADMIN.FROMNODE.<node-name>  uacc(none) owner(zSecure owner) 
pe CKNADMIN.FROMNODE.<node-name>  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)

rdef xfacilit CKNDSN.<dstype>.<node-name>.<systemname>.ACTIVE  uacc(none) owner(zSecure owner)
rdef xfacilit CKNDSN.<dstype>.<node-name>.<systemname>.BACKUP  uacc(none) owner(zSecure owner)
rdef xfacilit CKNDSN.<dstype>.<node-name>.<systemname>.MANAGED  uacc(none) owner(zSecure owner)
rdef xfacilit CKNDSN.<dstype>.<node-name>.<systemname>.PRIMARY  uacc(none) owner(zSecure owner)
pe CKNDSN.<dstype>.<node-name>.<systemname>.ACTIVE  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe CKNDSN.<dstype>.<node-name>.<systemname>.BACKUP  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe CKNDSN.<dstype>.<node-name>.<systemname>.MANAGED  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe CKNDSN.<dstype>.<node-name>.<systemname>.PRIMARY  class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe CKNDSN.<dstype>.<node-name>.<systemname>.ACTIVE  class(xfacilit) id(AUDTAUDT) access(UPDATE)
pe CKNDSN.<dstype>.<node-name>.<systemname>.BACKUP  class(xfacilit) id(AUDTAUDT) access(UPDATE)
pe CKNDSN.<dstype>.<node-name>.<systemname>.MANAGED  class(xfacilit) id(AUDTAUDT) access(UPDATE)
pe CKNDSN.<dstype>.<node-name>.<systemname>.PRIMARY  class(xfacilit) id(AUDTAUDT) access(UPDATE)

rdef xfacilit CKNDSN.<dstype>.<node-name>.<systemname>.CKRCMD  uacc(none) owner(zSecure owner)
pe CKNDSN.<dstype>.<node-name>.<systemname>.CKRCMD  class(xfacilit) id(SECAAUDT, SECBAUDT, SECDAUDT) access(READ)

rdef xfacilit CKR.READALL  uacc(none) owner(zSecure owner) 
pe CKR.READALL class(xfacilit) id(SYSPAUDT, SECAAUDT, SECBAUDT, TSTCAUDT) access(READ)

rdef xfacilit CKR.CKRCARLA.APF  uacc(none) owner(zSecure owner) 
pe CKR.CKRCARLA.APF class(xfacilit) id(SYSPAUDT, SECBAUDT) access(READ)

rdef xfacilit C2X.ICH*  uacc(none) owner(zSecure owner) 
pe C2X.ICH* class(xfacilit) id(AUTOAUDT, TSTCAUDT) access(UPDATE)

rdef xfacilit C2R.SERVER.ADMIN  uacc(none) owner(zSecure owner) 
pe C2R.SERVER.ADMIN class(xfacilit) id(SECAAUDT) access(READ)

rdef xfacilit C2R.CLIENT.SETROPTS  uacc(none) owner(zSecure owner) 
pe C2R.CLIENT.SETROPTS class(xfacilit) id(AUDTAUDT, SYSPAUDT, SECAAUDT) access(READ)

The zSecure programs CKFCOLL and CKGRACF, and the APF-authorized version of program CKRCARLA, must be restricted to security administrators, security batch jobs performing External Security Manager (ESM) maintenance, auditors, and systems programmers, and audited.

Description

Remediation - Manual Procedure