IBM OS/390 manual Enhancements to Support for OpenEdition Services, Uid

Enhancements to Support for OpenEdition Services

Enhancements to RACF's support for OpenEdition services include:

Ÿ Extended ability to audit the use of superuser status

ŸDefault USER/GROUP support provided by APAR OW26800

Extended Ability to Audit the Use of Superuser Status

This support allows the auditing of the new OpenEdition spawn service. determines when a user is a superuser and the identity of that use audit function allows a full audit trail that can be used to ensure adequate.

Auditing the	use of	superuser	status is performed using the ck_priv e
the PROCESS class processing to			audit	UID	and GID	changes. The audit
code 101 is	added.
If you are not already auditing the PROCESS class, issue SETROPTS
LOGOPTIONS(xxxx(PROCESS))		to obtain	the SMF	TYPE80	record	ck_priv.

Default

USER/GROUP

OMVS

Segment

Provided

by

APAR

OW26800

RACF

allows

definition of a system-wide

default

for

OMVS

segment

informati

making

it possible

for

users

not

specifically

defined

OpenEdition

MVS use

make use of OpenEdition services.

With

this

release, OpenEdition

sockets

are

the

primary

socket

interface

this support, RACF provides the ability to

define default

OpenEdition

i

setting a system-wide option.

Previously,

to

use

OpenEdition

services,

you

needed

to have a RACF USER

with an OMVS segment containing

a

UID

and

a

current

connect group

that

GROUP profile with an OMVS segment containing

a GID. If these were n

available, the initUSP service failed and the process could not

use

O

services.

Now,

if

no

OMVS segment

is found

in

the

USER

profile

during

initUSP

proc

the

default

OMVS segment

is used.

If

the

default

is

found,

it

is

u

HOME, and PROGRAM values for the user. If

no default value is found,

initUSP

fails

with

the

existing RACF

return

code

of

8

and reason

code

The same processing is done for the user's

current

connect

group.

If

segment is found in the GROUP profile,

the

default

is

used.

If

no

found,

the

initUSP

fails

with

the

existing

RACF

return

code

of

8

and

r

8.

After a default UID, GID,

or

both

are

assigned,

initUSP

processing

user is connected to additional RACF groups

and

list-of-groups processing

active, the supplemental group list is built

using the GIDs of these

groups.

No

default

processing

occurs while

the

supplemental

group

list

i

When initUSP assigns a default UID, GID, or both, it sets a bit in indicate that it is a default USP. This bit causes an additional rel added to any SMF TYPE80 records written by RACF callable services for t

6 OS/390 V2R4.0 Security Server (RACF) Planning: Installation and Migration