Does the LDAPSRV started task require permission to UID( 0) in Top Secret?
Article ID: 204953
Updated On:
Products
Issue/Introduction
IBM manual that states there are 3 ways to provide UID 0 access. They are as follows:
- Using the UNIXPRIV class profiles, the preferred way. See Using UNIXPRIV class profiles.
- Using the BPX.SUPERUSER resource in the FACILITY class. See Using the BPX.SUPERUSER resource in the FACILITY class.
Assigning a UID of 0, which is the least desirable way. See Assigning a UID of 0
Environment
Release : 15.0
Component : CA LDAP Server
Resolution
Top Secret can use UNIXPRIV(SUPERUSER.FILESYS) or (BPX.SUPERUSER) rule.
IBMFAC(BPX.SUPERUSER) is the same as giving UID(0), however since UID(0) has been removed and the ACID now has a unique UID, and you can pin point them for accountability
With UID(0) you can't tell which of the ID's that have that access did something.
Superuser Granularity for UNIXPRIV documented:
https://techdocs.broadcom.com/us/en/ca-mainframe-software/security/ca-top-secret-for-z-os/16-0/using/z-os-unix-system-services/superuser-granularity.html
Feedback
