IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

TYPE=ACCESS and CSDATA Fields

  • 1.  TYPE=ACCESS and CSDATA Fields

    Posted 07/31/24 01:05 PM

    When running a report on Access Monitor (TYPE=ACCESS) to look up usage information on a resource, is it possible to print the CSDATA segment field on the profile for the resource?

    newlist type=access nodetailinherit required,
       dd=genrlres nodup
    select,
            rectype=(auth,fast),
            access_result=0,
            class<>dataset
    sortlist,
    class,
    resource,
    access_profile,
    access_profile:csdata:$envgen("Environment",10)

    I have tried variations of the statement above with no luck.   It typically runs successfully, just no output in the report.



    ------------------------------
    Linnea Sullivan
    ------------------------------


  • 2.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/01/24 04:51 AM
    Edited by Rob van Hoboken 08/01/24 04:59 AM

    Hi Linnea

    You would use the implicit lookup function to add fields into a RACF_ACCESS report, CARLa will find the value related to the PROFILE.  See Object Property Lookup, here.  So printing the UACC of a profile is done by just adding :UACC in the SORTLIST command.

    I do now know (nor can I test) exact how this would work in newlist type=ACCESS, but I assume that the ACCESS_PROFILE takes over the function of PROFILE.  If so, you should be able to print CSDATA values, just add :$envgen (without the preceding base fields as you did in your sample).

    Note, the same trick would not work for the ID field, implicit lookup only works for the value of PROFILE.

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 3.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/08/24 02:28 PM

    Rob, thanks for the information.   As I mentioned we have started using CSDATA on Dataset and General Resource profiles.     I have been successful in reporting on the CSDATA with TYPE=RACF and TYPE=SMF.  But TYPE=ACCESS I am having no luck.  Now the jobs are not abending, I am just not seeing data in the field.

    The field on the general resource profiles is $envgen.   So I have tried:racf.$envgen,  access_profile:profile:$envgen , access_profile:$envgen and :$envgen

    Should I open a case with support?



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 4.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 05:02 AM
    Edited by Rob van Hoboken 08/09/24 05:03 AM

    Have you tried if the proper UACC shows up when you add :UACC in the sortlist line?

    if $ENVGEN is the name of a CSDATA field (including the $), then an object property lookup is supposed to work according to manual

    The optional base field is followed by one or more levels of lookup. If you omit the base field, the operation is called an object property lookup or implicit lookup. If the base field is present, the operation is an explicit lookup. Explicit lookups can be an ID lookup, a general lookup, or a deftype lookup. If there is more than one lookup operator (:), the operation is a multi-level lookup. Since release 2.5, the target field can also be a custom field name as defined in the CFIELD class in a RACF database.

    For the Object property lookup, information about the main object in the current record (most often an SMF record) is automatically determined as the base for the lookup in the security database.

    The object property lookup is supported only:



    - To default (no targettype specified) from ACCESS, AS_DD, COMPLIANCE, DSN, ID, RACF, RACF_ACCESS, RACF_ACCESS_ID, REPORT_SCOPE, RESOURCE, SENSDSN, SMF, and TRUSTED newlist types.
    ...

    I'm just guessing, but perhaps the object lookup works off the SIM_PROFILE field.  If adding :UACC does not add a valid UACC value in your report, can you also add SIM_PROFILE to check my guess?  So

    sortlist,
    class,
    resource,
    access_profile,
    sim_profile,
    :uacc,
    :$envgen("Environment",10)

    And... you are running 2.5.0 or 3.1.0 of course?

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 5.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 08:49 AM

    Yes, currently Version 2.5.0



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 6.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 10:30 AM

    Rob, Well I thought I tried :$envgen before on the SORTLIST and it did not work.   But today it works.   

    sortlist,
      class,
      access_profile(25),
      resource(40),
      :$envgen("Environment",12),
      userid userid:name,
      last_datetime,
      intent(9),
      access_allowed,
      rectype,
      req_status_access(6,hb),
      access_result(5,"AccRC",dec),
      system(8),
      sim_via,
      sim_via_groups

    So we are good for General Resources.

    I tweaked the SELECT / SORTLIST for Datasets but the $envdsn field does not report anything:

     select,
            rectype=(auth,fast,def),
            access_result=0,
            class=dataset access_profile=:syssa
    sortlist,
      class,
      access_profile(25),
      resource(40),
      :$envdsn("Environment",12),
      userid userid:name,
      last_datetime,
      intent(9),
      access_allowed,
      rectype,
      req_status_access(6,hb),
      access_result(5,"AccRC",dec),
      system(8),
      sim_via,
      sim_via_groups

    Would there be anything different about datasets compared to resources?



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 7.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 10:48 AM

    I don't think there is a structural difference between GENERAL and DATASET profiles for these reports.

    Now that you've established that GENERAL profile access lists the $ENVGEN value, can you tweak the newlist and (for this test) remove the SIM_ fields from the sortlist command?  If my hypothesis is right, $ENVGEN will be empty again. If that's the case, remember that ACCESS_PROFILE lists the profile as logged in the ACCESS record, and SIM_PROFILE is the profile that matches RESOURCE in the current RACF database.  The SIM_VIA and SIM_VIA_GROUP fields (and your $ENVGEN value) rely on the SIM_PROFILE value.

    If there is no profile matching RESOURCE in the (current) RACF database, the SIM_ values and the corresponding lookups will be empty.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 8.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 10:48 AM

    Let me ask a related question.   Are we able to use object lookup on a SELECT statement?

    For example:

       106 | select,
       107 |        rectype=(auth,fast,def),
       108 |        access_result=0,
       109 |        req_status_access<>yes,
       110 |        :$envgen=p
    CKR0432 12 Format Unknown not supported for selection - field  at SYSIN line 110

    or

       107 |        rectype=(auth,fast,def),
       108 |        access_result=0,
       109 |        req_status_access<>yes,
       110 |        :Sim_profile.$envgen=p
    CKR1277 12 Implicit lookup to type SIM_PROFILE not supported from type access at SYSIN line 110

    or

       107 |        rectype=(auth,fast,def),
       108 |        access_result=0,
       109 |        req_status_access<>yes,
       110 |        :$envgen='p'
    CKR0432 12 Format Unknown not supported for selection - field  at SYSIN line 110



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 9.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/09/24 10:57 AM
    Edited by Rob van Hoboken 08/09/24 10:59 AM
    1. $envgen is only supported in an object property lookup, that is one without a base field.
    2. ID lookups (that is lookups with a base field) are limited to user and group profiles,  i.e., you can do user:name and user:$deptid, but not dataset:instdata or sim_profile:uacc
    3. :sim_profile is just wrong, since sim_profile is a proper field in ACCESS, sim_profile could be used as a base field for deftype lookup (not for ID lookup)
    4. it looks like the CARLa parser does not have the logic to use implicit lookup of CSDATA fields in the select command, this is expressed by CKR0432.
      I wonder if select .... :uacc>READ would be supported, I think I remember it is.

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 10.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/13/24 01:43 PM

    I got both the CSDATA field on a generalized resource profile and dataset profile to work.    It seems that if you use any of the SIM fields in the sortlist (SIM_PROFILE, SIM_VIA, SIM_VIA_GROUPS) then you can get the data in the look up of the fields.



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 11.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/20/24 12:55 PM

    Rob, I posted a few questions about six days ago.   Could you or someone look at them?



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 12.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/20/24 04:32 PM
    Edited by Rob van Hoboken 08/20/24 05:52 PM

    Hi Linnea,

    I don't work for IBM any more, I only try to help zSecure users, answer questions and recommend CARLa code solutions from memory and my 35 years of experience with zSecure.

    With regards to the lack of function with using implicit lookup in the select command, I suggest you contact support since there is no mention in the doc that these lookups to CSDATA values are output only, so they should work in select.

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 13.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/21/24 06:11 AM

    Hi Linnea,

    I have been looking at them. My impression is that some of this is not as I would want it to work, but I have not figured out in how far this would qualify as a problem in existing code, so I held off on directing you to open a Case until I would have had more time to research that. You can go ahead and open a Case, though. Frankly, I would expect to reach a conclusion in another week or so. (I want to consult someone who is currently on vacation.)

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 14.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/27/24 09:11 AM

    This what the TYPE=ACCESS what the documentations states:

    "When using any of the SIM_* fields or when the SIMULATE RACF_ACCESS statement has been specified,
    resource names in the input ACCESS file are matched against the profiles in the allocated RACF input
    source."

    In other words, if you do not use the SIM_* field or the SIMULATE RACF_ACCESS statement, there is no (CPU costly attempt) to figure out the RACF profile in the connected RACF database, and hence implicit lookups do not work. We could consider an enhancement that an implicit lookup in type=access should automatically trigger SIMULATE RACF_ACCESS.



    ------------------------------
    Hans Schoone
    Chief Architect zSecure
    IBM - zSecure architect
    Delft
    ------------------------------



  • 15.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/13/24 01:47 PM

    It seems like we cant do anything on a Select for the CSDATA field on TYPE=ACCESS.

    I assume defining a new field would serve no purpose.

    My solution may be a two step process, #1  Output the report with the CSDATA field, #2 Use that output as input to a second step and do my selections as needed.

    Would this be a good topic for an IDEA?



    ------------------------------
    Linnea Sullivan
    ------------------------------



  • 16.  RE: TYPE=ACCESS and CSDATA Fields

    Posted 08/13/24 02:59 PM

    Concerning the CKR0432 message.   It seems to indicate that certain types of fields may work?   Maybe a BIT Field.   We just defined these new CSDATA fields so I could go back and delete them and start over with new ones if that would work on the SELECT Statement lookup.



    ------------------------------
    Linnea Sullivan
    ------------------------------