Possible security failures when EZB.STACKACCESS profile exists for SAFSERVAUTH class


Sites may experience security violations in SAS jobs about user or job not having sufficient access to EZB.STACKACCESS.sysname.tcpname for SERVAUTH class, where sysname is the sytem name and tcpname is the started task name for TCP/IP. This message can occur during initialization of SAS system in SAS 9.1 and beyond because TKITCP does a call to gethostname().

Examples of the messages reported from some security products are:

Top Secret:

TSS7251E ACCESS DENIED TO SERVAUTH <EZB.STACKACCESS.sysname.tcpname>

RACF:

ICH408I USER(userid  ) GROUP(groupid ) NAME(registered user name   )
EZB.STACKACCESS.sysname.tcpname CL(SERVAUTH)
INSUFFICIENT ACCESS AUTHORITY
ACCESS INTENT(READ    ) ACCESS ALLOWED(NONE    )

The solution is to define the user or group to have READ access to SERVAUTH class or define SERVAUTH class with Universal Access of READ.