eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Controlling HFS Using the Native UNIX Security ModelProcesses that Affect HFS SecurityWhen using the UNIX security model, various options can affect the filevalidation process. The processes and their effect on file security or validationare described in this section.HFS FASTPATH CheckingAs of OS/390 V2R7, OMVS issues a SAF call at initialization. This SAF callchecks to see if access is authorized for OMVS to the FACILITY class resourceBPX.SAFFASTPATH. If access is allowed, OMVS performs permission bitchecking internally instead of calling the external security manager bypassingany audit trail of violations. This is referred to as FASTAUTH processing.Issue the following eTrust CA-Top Secret commands to eliminate this bypass:TSS ADDTO(anydept) IBMFAC(BPX.SAFF)TSS PERMIT(ALL) IBMFAC(BPX.SAFF) ACCESS(NONE)Also, do not give the STC acid associated with the OMVS started task theNORESCHK attribute.MOUNT NOSECURITYWith OS/390 V2R7, you now have the option to MOUNT a file system or part ofa file system with or without SECURITY. The use of the MOUNT commandrequires superuser authority. If the file system is mounted with theNOSECURITY option, USS makes access checks against system credentials (i.e.,superuser) rather that against user credentials. Access is allowed.Program Control in the UNIX EnvironmentWhen the BPX.DAEMON and BPX.SERVER facilities are active, processingauthorized functions, such as SETUID, requires that programs or executables beloaded from an authorized library. In a eTrust CA-Top Secret environment,these authorized data sets are any library in the LPA list, the APF list, orLINKLIST. If a program is loaded from the HFS or an MVS data set not on theapproved lists, the TCBNCTL flag, referred to as the “dirty bit,” is set. Thisresults in authorized functions failing if attempted in the “dirty” environment.When an executable or program is requested in an OMVS environment, OMVSfinds the executable in the HFS and loads from there unless the programcontrolled extended attribute, or “sticky bit,” is set. If this sticky bit is set on theexecutable file, OMVS uses normal MVS load processing. To avoid the dirty bitbeing set requires that the executables in the HFS have the sticky bit turned onusing the chmod command.Controlling Access to the Hierarchical File System 2–3