zOS CFRM - Structure size change requires access to CSFSERV resources

When Coupling Facility (CF) structures are encrypted, any user executing the IXCMIAPU utility to write or update a CFRM policy currently requires access to CSFSERV resources such as CSFKGN (Key Generate) and CSFKYT (Key Test)—even in scenarios where no cryptographic changes are made (e.g., updating only the SIZE or structure definitions).

This requirement introduces a conflict in environments with segregation of duties, where:

• z/OS administrators are responsible for CFRM policy management (structure size, name, preference list, etc.)

• Crypto administrators are responsible for key generation, key management, and cryptographic operations

Today, even non-cryptographic updates to CFRM policies force z/OS administrators to be granted access to sensitive CSFSERV resources, which violates least-privilege principles.

Additionally:

• CF structure encryption keys are stored within the CFRM policy dataset (on CDS volumes) rather than in ICSF key datasets (xKDS), meaning they are not protected via CSFKEYS profiles

• Existing access control mechanisms allow restriction at the key level or service level, but not contextually based on who is calling the service (e.g., IXCMIAPU) or for what purpose

• Conditional access (e.g., WHEN clauses) is not supported for class CSFSERV, preventing program-based restriction (e.g., WHEN(PGM=IXCMIAPU))

Proposed Enhancement

Introduce a more granular and context-aware access control mechanism for CSFSERV resources used in CF structure encryption, enabling:

1. Program-based access control for CSFSERV
Allow constructs such as:

PERMIT CSFKYT CLASS(CSFSERV) ID(group) ACCESS(READ)
  WHEN(PGM(IXCMIAPU))

This would ensure that sensitive crypto services can only be invoked via approved utilities.

2. Service-context-based conditional access
Introduce a new control mechanism (e.g., via XFACILIT class), such as:

CSF.CSFSERV.CONDITIONAL.ACCESS.CONTROL

enabling policies like:

PERMIT CSFKYT CLASS(CSFSERV) ID(group) ACCESS(READ)
  WHEN(CRITERIA(SERVICE('CFRM-Encryption')))

3. Separation of cryptographic vs. non-cryptographic operations in IXCMIAPU
Enhance IXCMIAPU to distinguish between:

• operations requiring cryptographic services (e.g., key generation, rekeying)

• administrative updates (e.g., SIZE changes, structure definitions)

Value

• Enables true segregation of duties between system and crypto administrators

• Enforces least-privilege access to sensitive ICSF services

• Reduces operational friction for CFRM policy management

• Aligns CF encryption handling with enterprise security and compliance requirements