Different TSSUTIL output depending on the users submitting the report.
Article ID: 236273
Updated On:
Products
Issue/Introduction
The same TSSUTIL report submitted by different users generates different outputs.
For example:
TSSUTIL is submitted with the same commands by 3 different users.
The commands are:
REPORT
DATASET(TEST001.ABCD000.DE0XXXX.LIB,TEST002.ABCD000.DE0XXXX.LIB)
EVENT(ALL)
DATE(TODAY)
TIME(120000)
The user USERA submits the TSSUTIL and gets the following output
CA TOP SECRET VERSION 16.0 SECURITY ACTIVITY/INCIDENTS REPORT # 01 10/01/22 10:10:01 PAGE 00001
DATE TIME SYSI ACCESSOR JOBNAME FFM VC PROGRAM R-ACCESS A-ACCESS SRC/DRC SEC RESOURCE (TYPE & NAME) JOBID TERMINA
-------- -------- ---- -------- -------- --- -- -------- -------- -------- ------- --- ---------------------------- ------- -------
+
+
10/01/22 09:10:00 CPUA USERB JOB00001 B F IEFIAB READ CREATE OK+B OPN D EX0001 TEST002.ABCD0000.DE0 J001010 INTRDR
10/01/22 09:11:01 CPUA USERX JOB00002 B F DSNECT40 READ READ OK+A OPN D EX0002 TEST001.ABCD0000.DE0 J003821 INTRDR
When USERB submits the same TSSUTIL gets the following output
CA TOP SECRET VERSION 16.0 SECURITY ACTIVITY/INCIDENTS REPORT # 01 10/01/22 10:11:01 PAGE 0001
DATE TIME SYSI ACCESSOR JOBNAME FFM VC PROGRAM R-ACCESS A-ACCESS SRC/DRC SEC RESOURCE (TYPE & NAME) JOBID TERMINA
-------- -------- ---- -------- -------- --- -- -------- -------- -------- ------- --- ---------------------------- ------- -------
+
+
10/01/22 09:10:00 CPUA USERB JOB00001 B F IEFIAB READ CREATE OK+B OPN D EX0001 TEST002.ABCD0000.DE0 J001010 INTRDR
In this report, there is no information about the access done by the USERX to the resource TEST001.ABCD0000.DE0
When USERC submits the same TSSUTIL the report is empty.
Environment
Release : 16.0
Component : Top Secret for z/OS
Cause
The users can only extract the incidents that are generated for ACIDs within the scope of their authority.
The normal users (Like USERB and USERC ) can only get information about their personal incidents.
The USERA is an administrator (SCA) so the report contains access to resources done by any acid under his scope (USERB , USERC, USERX, etc)
In the TSSUTIL submitted by USERA, it is possible to see the access done by USERB to TEST002.ABCD0000.DE0 and the access done by USERX to TEST001.ABCD0000.DE0.
There is no information for any access done by the acid USERC
When the TSSUTIL is submitted by USERB the job only shows information about access to TEST002.ABCD0000.DE0 done by USERB.
When the TSSUTIL is submitted by USERC there is no info but this is because this user has not accessed any dataset (TEST002.xxx or TEST001.xxx )
In summary, the users submitting TSSUTIL only will see information about the user's personal incidents.
Resolution
Submit TSSUTIL using USERs with administrative authority to obtain information of users within the scope of their authority.
Additional Information
More information about Scope and Authority running TSSUTIL is available at the following link:
Feedback
