Refer to the following report produced by the ACP Data Collection:
- SENSITVE.RPT(MQSRPT).
Verify ACP datasets rules for WebSphere MQ system datasets (e.g., SYS2.MQM.) restrict access as follows. If the following guidance is true, this is not a finding.
Note: ssid is the queue manager name (a.k.a., subsystem identifier).
If the following guidance is true, this is not a finding.
The ACP dataset rules for the datasets restrict READ access to datasets referenced by the following DDnames, restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All access to these datasets is logged.
DDname Procedure Description
CSQINP1 ssidMSTR Input parameters
CSQINP2 ssidMSTR Input parameters
CSQXLIB ssidCHIN User exit library
The ACP dataset rules for the datasets restrict WRITE and/or greater access to the above datasets to WebSphere MQ administrators and systems programming personnel.
The ACP dataset rules for the datasets restrict WRITE and/or greater access to datasets referenced by the following DDnames, restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All WRITE and/or greater access to these datasets is logged.
DDname Procedure Description
CSQPxxxx ssidMSTR Page datasets
BSDSx ssidMSTR Bootstrap datasets
CSQOUTx ssidMSTR SYSOUT datasets
CSQSNAP ssidMSTR DUMP dataset
(See note) ssidMSTR Log datasets
Note: To determine the log dataset names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain dataset names.
The ACP dataset rules for the datasets restrict ALTER access to archive datasets, restricted to WebSphere MQ STCs, WebSphere MQ administrator, and systems programming personnel. All ALTER access to these datasets is logged.
Note: To determine the archive datasets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 dataset high-level qualifiers.
Except for the specific dataset requirements just mentioned, WRITE and/or greater access to all other WebSphere MQ system datasets is restricted to the WebSphere MQ administrator and systems programming personnel.