Top Secret Equivalent of TRUSTED=YES In RACF

Products

• Top Secret for z/OS
• Top Secret for z/VM

Issue/Introduction

What is the  Top Secret equivalent of TRUSTED=YES in RACF?

Resolution

Although there is not a single Top Secret attribute that is the equivalent of TRUSTED=YES in RACF, there are the bypass attributes in Top Secret such as NODSNCHK, NOVOLCHK, NORESCHK, NOSUBCHK, and NOLCFCHK, that can be given to an ACID to bypass security checks. All bypass attributes that result in an access permission are audited to the Audit and Tracking File.

For STC ACIDs, there is also the BYPASS attribute as an alternative :

TSS ADD(STC) PROCNAME(xxxx) ACID(BYPASS)

 

There are Started Tasks that can have the BYPASS attribute and do not generate audit findings.

The Trusted Started Tasks table on STIG ID BTSS0019 lists which Started Tasks can have this attribute.

 

On top of the bypass, the ACID must be superuser in USS and being the the owner or being part of the directory group it needs to access. This can be achieved with:

Giving the ACID superuser access

TSS ADD(acid) UID(0) 

or

TSS PER(acid) UNIXPRIV(BPX.SUPERUSER) ACC(READ)

Owning a directory or being in a group from the directory

Making the user owner of the directory or file via USS chown command

or

Adding the directory GROUP to the user via USS addgroup command