The IBM RACF classes required to properly secure the z/OS UNIX environment must be ACTIVE.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-223850 | RACF-US-000130 | SV-223850r958730_rule | CCI-002233 | medium |
| Description | ||||
| In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations. | ||||
| STIG | Date | |||
| IBM z/OS RACF Security Technical Implementation Guide | 2025-06-24 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
AC-6(8)
1.00
- DISA · 9 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-002233
1.00
- DISA · 9 · disa_xccdf · related
Details
Check Text (C-223850r958730_chk)
From the ISPF Command Shell enter:
SETRopts list
If the ACTIVE CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, this is not a finding.
If either of the above resource classes is missing, this is a finding.
Fix Text (F-25511r515239_fix)
Define the ACTIVE CLASS Parameter in SETROPTS to include the FACILITY, SURROGAT and UNIXPRIV resource classes.
EXAMPLES:
SETR CLASSACT(FACILITY SURROGAT UNIXPRIV)
SETR GENERIC(FACILITY SURROGAT UNIXPRIV)
SETR GENCMD(FACILITY SURROGAT UNIXPRIV)
SETR RACL(FACILITY SURROGAT UNIXPRIV)