STIGQter: STIG Summary: zOS WebSphere MQ for RACF Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

WebSphere MQ resource classes must be properly activated for security checking by the ESM.

DISA Rule

SV-224557r1145056_rule

Vulnerability Number

V-224557

Group Title

SRG-OS-000080

Rule Version

ZWMQ0049

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

Ensure that all WebSphere MQ resources are active and properly defined.

Ensure the following WebSphere MQ resource classes are active:

GMQADMIN
GMQNLIST
GMQPROC
GMQQUEUE
MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries:

GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Note: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

The following sample contains commands to activate the required classes:

SETR CLASSACT(MQADMIN MQCMDS MQCONN)
SETR CLASSACT(MQNLIST MQPROC MQQUEUE)
SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)

Check Contents

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes

Automated Analysis
Refer to the following report produced by the RACF Data Collection:

- PDI(ZWMQ0049)

Verify the following WebSphere MQ resource classes are active, this is not a finding.

GMQADMIN
GMQNLIST
GMQPROC
GMQQUEUE
MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

If SCYCASE is set to MIXED, ensure the following WebSphere MQ resource classes are active, this is not a finding.

GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Note: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

Vulnerability Number

V-224557

Documentable

False

Rule Version

ZWMQ0049

Severity Override Guidance

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes

Automated Analysis
Refer to the following report produced by the RACF Data Collection:

- PDI(ZWMQ0049)

Verify the following WebSphere MQ resource classes are active, this is not a finding.

GMQADMIN
GMQNLIST
GMQPROC
GMQQUEUE
MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

If SCYCASE is set to MIXED, ensure the following WebSphere MQ resource classes are active, this is not a finding.

GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Note: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

Check Content Reference

M

Target Key

4167