eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

OpenEdition MVS / UNIX System Services SupportTo create a Superuser Administrator acid and give it the authority it needs,follow these directions:Step 1—Define the acid as a superuser by issuing the following TSS command:TSS ADD(acid) UID(0)ACID SYSPROG1 is defined as a superuser by setting the UID value to zero.Step 2—Define SYSPROG1 as a member of a group by issuing:TSS ADD(acid) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)The example shows ACID SYSPROG1 changed so that this user can sign on andbe validated as a member of group OMVSGRP. The acids of group OMVSGRPare a special subset of users who perform system-related tasks.Superuser GranularitySuperuser Granularity support lets you avoid giving users superuser authorityvia UID(0). This is accomplished by allowing non-superuser users to have accessto new resources in the UNIXPRIV class. At OS/390 V2R8 and above, if a userdoesn't have a UID=0, but they do have access to one of the new resources,access is allowed. The following table defines the new resources and what accessis allowed by the resource.eTrust CA-Top Secret SAF HFS security provides much greater superusergranularity than this method. See Chapter 2 of this guide for details onimplementing eTrust CA-Top Secret's SAF HFS security. Activating eTrustCA-Top Secret SAF HFS security will override the superuser granularitysupport described in this section if there is an equivalent SAF HFS securityresource for the UNIXPRIV resource. If there is no SAF HFS resource, theUNIXPRIV resource is checked instead.Resource Name Access Given Functions AffectedSUPERUSER.FILESYS.FILE (READaccess or higher)SUPERUSER.FILESYS.FILE(UPDATE access or higher)SUPERUSER.FILESYS.FILE(CONTROL Access)SUPERUSER.FILESYS.CHOWNAllows a user to read any HFSfile and read or search anyHFS directoryAllows a user to write to anyexisting HFS file.Allows a user to write to anyHFS directory.Allows a user to changeownership of any file.Open*( for read, opendir(),readlink(), stat(), realpath(0)Open() for writeLink(), mkdir(), rename(),mdir(), syslink(), unlink().Chown()1–16 Cookbook