|
jte wrote: > >Not really. It's possible that I may want to use an exit program that >would adopt it's owner's authority, but not necessarily *ALLOBJ >authority. The restriction of requiring *ALLOBJ and *SECADM to >register the exit program is sufficient, requiring the exit program to >be owned by an *ALLOBJ profile would be onerous. > the chgc0100 exit pgm needs to adopt *allobj/*secadm rights? If that is needed, the exit pgm could call a pgm that adopts that authority. Requiring the exit pgm to be owned by a fully privledged user ( is not *FullPriv more descriptive than *allobj/*secadm ? ) prevents the replacement of the registered exit pgm by a user with lesser authority. > >All of the above are just examples of how a person who has *ALLOBJ >authority can compromise your system in an infinite number of ways. A >good approach is to make security work right up to the point that >someone acquires *ALLOBJ authority. At that point, it is impossible >to secure anything from that person, so stop trying. The restriction >on exit program registration is sufficient, more than that and you >start to limit function without providing additional security. disagree. the way it is now, if QPGMR owns the exit pgm, anyone in the Qpgmr group can replace an exit pgm that was registered by an *allobj user. The new pgm will be run by many different users on the system, some with *allobj authority. Code in the new pgm could then check that the user is a known *allobj/*secadm aut user and then do whatever it wants on the system. Requiring the exit pgm be owned by an *a/*s user prevents this and does not limit functionality. Steve Richter +--- | This is the Midrange System Mailing List! | To submit a new message, send your mail to MIDRANGE-L@midrange.com. | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com. | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com. | Questions should be directed to the list owner/operator: david@midrange.com +---
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.