IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Forcing TRACE(YES) for STARTED profiles

    Posted 2 days ago

    Greetings,
    I would like to enforce that all STARTED profiles have TRACE(YES).
    Can I do this with a CV profile such as,
    RDEF XFAC C4R.STARTED.=TRACE.** APPLDATA(YES) OWNER(....)  etc.
    or do I have to modify this in some way to indicate the TRACE value is in the STDATA segment?


    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------


  • 2.  RE: Forcing TRACE(YES) for STARTED profiles

    Posted yesterday

    The manual suggests that TRACE is handled the same as PRIVILEGED and TRUSTED, i.e., options whose use must be strictly controlled: https://www.ibm.com/docs/en/szs/3.2.0?topic=profiles-policy-stdata-segment-management.  There is no function that applies mandatory use of the TRACE keyword.

    Since NOTRACE doen't seem to introduce an immediate security risk, you could run a daily CARLa step that selects the segments with SELECT SEGMENT=STDATA FLAGTRAC=NO



    ------------------------------
    Rob van Hoboken
    ------------------------------

    Original Message


Related Content