IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Can anyone help to generate a report using CARLa to list all the Dataset profile a user gains ALTER-O access via Group Operations?

  • 1.  Can anyone help to generate a report using CARLa to list all the Dataset profile a user gains ALTER-O access via Group Operations?

    Posted Fri February 12, 2021 04:37 PM

    We have Operators defined to multiple groups with GROUP OPERATIONS, and these groups have more than 50 subgroups defined to them each. And there are lot of Dataset profiles defined with these sub groups as DEFAULT grp / Owner. So the Operators gain ALTER-O access to all these dataset profiles. For Auditing, we need to generate a report using CARLa to list all the DATASET profiles a user can gain ALTER-O access via Group Operations. Is there a simplified method or query to generate this report from Parent groups instead of creating a script to list all the dataset profiles that has DEFAULT grp / OWNER equals to SUBGROUPS.

    Regards,

    Nagendra


    #ZSecurity
    #SupportMigration
    #Support


  • 2.  RE: Can anyone help to generate a report using CARLa to list all the Dataset profile a user gains ALTER-O access via Group Operations?
    Best Answer

    Posted Thu February 18, 2021 10:51 AM

    First of all, you should realize that OPERATIONS privilege is not intended for Operators. This privilege gives (you) the ability to delete (and move) data sets and also, due to the hierarchical access levels in RACF, to READ and UPDATE data sets that you have not been given explicit access to. And finally, to modify DISCRETE profiles.

    This privilege can often be replaced with STGADMIN permissions, that do not allow reading or updating data sets.

    Users with Group Operations can be found using RA.U, selecting the Attributes checkbox. This executes a report similar to

    newlist type=racf select GrpOp sortlist profile("Userid",8) connects

    Showing the data sets a single (or up to 6) user(s) can access is the scope report in RA.3.4. Chose option 3 and on the prompt panel you skip all access reasons except Group operations and Owner. This shows you the access via PERMIT, CONNECT and via Group Operations. And profiles OWNED by the user, which is not what you wanted, but there is a bug in REPORT SCOPE....

    Now, can we combine these two reports? Yes. You store the following CARLa in a member of your private CARLa library. Go to CO.1 and make sure your library is in the list of data sets, and selected. Select the library with E and type an R in front of the member.

    newlist type=racf nopage dd=ckr2pass define once(nd) boolean where exists(complex) define each(nd) count select GrpOp summary once, 'SUPPRESS REASON=( UACC ID(*) GLOBAL WARNING NOPROF SPECIAL AUDIT,', / 'GRPAUDIT GRPSPEC PWDCHANGE SELFCON ALTER-M CKGRACMAP,', / 'CKGRACDCERT CKGOWNER CREATE)', / 'N REQUIRED N=SCOPE0D T=:T1 TYPE=REPORT_SCOPE', / ' DEFINE HIGH_ACCESS("HighAcc") MAX(ACCESS)', / ' s class=dataset exists(via:supgroup)', / ' x access=(none,execute,read,update,control,alter)', / ' x access=(add-s,ad-read,d-read)', / ' d key(nondispl) class,', / ' proftype(detail) key(both,"Profile name") volser(detail),', / ' access_via_when(76),', / ' / key(0,d,wrap,firstonly,"Full profile name",header),', / ' / access_via_when(d,header,76)', / ' summary complex id * class count(8,"Profiles") HIGH_ACCESS' summary each, 'report scope=' | key(0)

    Running the CARLa program generates another CARLa program that looks like this:

    SUPPRESS REASON=( UACC ID(*) GLOBAL WARNING NOPROF SPECIAL AUDIT, GRPAUDIT GRPSPEC PWDCHANGE SELFCON ALTER-M CKGRACMAP, CKGRACDCERT CKGOWNER CREATE) N REQUIRED N=SCOPE0D T=:T1 TYPE=REPORT_SCOPE DEFINE HIGH_ACCESS("HighAcc") MAX(ACCESS) s class=dataset exists(via:supgroup) x access=(none,execute,read,update,control,alter) x access=(add-s,ad-read,d-read) d key(nondispl) class, proftype(detail) key(both,"Profile name") volser(detail), access_via_when(76), / key(0,d,wrap,firstonly,"Full profile name",header), / access_via_when(d,header,76) summary complex id * class count(8,"Profiles") HIGH_ACCESS report scope=CRMQAN24 report scope=CRMQA002 report scope=CRMQA1O report scope=Q303019D

    Once you see this program, press F3 and type an R in front of the CKR2PASS dd name. This produces the list of users with group operations, and you can see the individual data set profiles by selecting each user.


    #Support
    #SupportMigration
    #ZSecurity


  • 3.  RE: Can anyone help to generate a report using CARLa to list all the Dataset profile a user gains ALTER-O access via Group Operations?
    Best Answer

    Posted Fri February 26, 2021 05:50 PM

    Rob,


    Thanks for your response and appreciate your time and effort. This is perfect which is what we were looking for.


    Thanks for your advise on Operators access to GRP Operations, We are worried on it as well, that's one of the reason we wanted to look on this report for audit.


    Regards,

    Nagendra


    #Support
    #ZSecurity
    #SupportMigration