Using SECTRACE for PRIVPGM security violations

Products

• Top Secret

Issue/Introduction

Determine PROGRAMs being used to access a DATASET when PRIVPGM datasets PERMIT restrictions are being used.

Example:

TSS PERMIT(JOE) DSN(PROD.DATASET) PRIVPGM(PROGA,PROGB,PROGC) ACCESS(READ)

This PERMIT allows user JOE to access dataset PROD.DATASET ***ONLY*** when using PROGRAMs called PROGA, PROGB and PROGC.

Environment

Release : 16.0

Resolution

instructions to activate the trace.

 

1. TSS ADD(acid) TRACE

2. TSS REFRESH(acid) JOBNAME(*)

3. TSS MODI(SECTRACE(ACT,WTL))

4. This will route all trace records to the MVS syslog....

5. Recreate the problem.

6. TSS MODI(SECTRACE(OFF))

7. TSS REM(acid) TRACE

8. TSS LIST(acid) DATA(ALL,PROFILE)

9. Please email trace to [email protected] as a text file with the ticket number as the subject.

 

SECTRACE shows:

 

X TSS-C-086B*TSOUSER  TSOLFUR  T DATASET 2088 G/0808011900,0820200000 L/A00002 F/00000330,000100,0021,000038                       

 N 0080000 SYSX     23123 14:03:42.03 TSU28381 00000295  TSS7220E 107 J=TSOLFUR A=TSOLFUR VOL=CTMQ00 ACC=READ DSN=SYS2.CONTROLM.Q   

 S                                                       A.IOAI.PARM                                                                

 X TSS-1 400010006000 00000000   T/0000010401 CTMQ00 SYS2.CONTROLM.QA.IOAI.PARM                                                      

 X TSS-2 130600 R/128800 S/500980,020000000000   TBNYV035 A/010080 P/IOATBMN ,0B22,IOAPRML ,ISPTASK  F/80020600                     

 X TSS-3                             IOATBMN  00022C                                                                                 

 X TSS-4 00000000 00AFC740 7FF53CA0  REQ/         SUB/         US/         RS/   

 The following dataset is accessed: 

SYS2.CONTROLM.QA.IOAI.PARM    

Programs in the TCB (task control block) accessing the dataset which neeed to be in the PRIVPGM keyword for the PERMIT.

IOATBMN

IOAPRML

ISPTASK

 

6B indicates a PRIVPGM security violation.

TSOUSER is the user with the security violation.

SECTRACE detail/record layout is located in the Top Secret Documentation.