IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Type =Trusted base segment for datasets

    Posted 06/28/23 04:43 PM

    I am running the Trusted report using the following Carla code

    newlist type=trusted title="direct permits"

      select class=dataset userid_privilege=permitUsr

      summary complex system resource racf_profile,

       racf_profile:uacc userid "-"(8) access risk senstype,

       auditpriority,

       concern(firstonly,140)

    newlist type=trusted title="connected to groups with a permit"

      select class=dataset userid_privilege=permitGrp

      summary complex resource racf_profile,

      racf_profile:uacc userid via access risk senstype,

      auditpriority,

      concern(firstonly,140)

    newlist type=trusted title="excessive UACC"

      select class=dataset userid_privilege=Uacc

      summary complex resource racf_profile,

      racf_profile:uacc "*"(8) "-"(8) access risk senstype,

      auditpriority,

      concern(firstonly,140)

    This is working ok except that there are spaces in the UACC field. I believe that this is due to the dataset profiles having a DFP segment. if I run a Type =RACF it shows two profiles one with UACC that is spaces and the other with the correct UACC. Since spaces will sort first, I believe that this is what the Trusted report is using..

    If I run the following Carla code :

    NEWLIST type=racf nopage

       Select class=dataset

       sortlist complex(4) key(44) uacc(7)

    I get results like :

    TEST  CICS.TEST.*.SDFHAUTH.**

    TEST  CICS.TEST.*.SDFHAUTH.**                 NONE

    If I add segment=base:

    NEWLIST type=racf nopage

       Select class=dataset segment=base

       sortlist complex(4) key(44) uacc(7)

     then I only get the profile that has the correct UACC. However when I try and use this on a TYPE =Trusted then I get an error message 

    CKR0425 12 Field "SEGMENT" to be processed not valid for NEWLIST TYPE=TRUSTED

    Is the any way to get the Trusted report to just look at the base dataset segment to get the UACC?


       

       



    ------------------------------
    Peter Roberts
    ------------------------------


  • 2.  RE: Type =Trusted base segment for datasets

    Posted 06/29/23 03:48 AM
    Edited by Rob van Hoboken 06/29/23 03:49 AM

    The lookup racf_profile:uacc is called an ID lookup, and is only available for USER and GROUP entities in the base field.  See language manual.

    To look up the attributes of dataset and general profiles, you can only use the object property lookup.  This is :uacc, without a base field.  It finds the most relevant profile or object for the newlist type, and shows the RACF field value for that profile.  So:

    summary complex system resource racf_profile,

       :uacc userid "-"(8) access risk senstype,

       auditpriority,

       concern(firstonly,140)


    ------------------------------
    Rob van Hoboken
    ------------------------------



Related Content