Top Secret Equivalent of TRUSTED=YES In RACF

Products

• Top Secret
• Top Secret - LDAP

Issue/Introduction

What is the  Top Secret equivalent of TRUSTED=YES in RACF?

Resolution

1. Although there is not a single Top Secret attribute that is the equivalent of TRUSTED=YES in RACF, there are the bypass attributes in CA Top Secret such as NODSNCHK, NOVOLCHK, NORESCHK, NOSUBCHK, and NOLCFCHK, that can be given to an ACID to bypass security checks. All bypass attributes that result in an access permission are audited to the Audit and Tracking File.

For STC ACIDs, there is also the BYPASS attribute as an alternative :

TSS ADD(STC) PROCNAME(xxxx) ACID(BYPASS)

There are Started Tasks that can have the BYPASS attribute and do not generate audit findings.

The Trusted Started Tasks table on STIG ID BTSS0019 lists which Started Tasks can have this attribute.

2. ***AND*** Give superuser authority via:

TSS ADD(acid) UID(0) ***OR***
TSS PER(acid) UNIXPRIV(BPX.SUPERUSER) ACC(READ)

3. ***AND*** Give user USS permission to the directories it needs by:

Making the user owner of the directory or file via USS chown command ***OR**  
Adding the directory GROUP to the user.via USS addgroup command