Re: IFS security problem

*This message was transferred with a trial version of CommuniGate(tm) Pro*
Thanks Evan,

The owner of the parent directory is DNET, defined with both data AND object
management rights to this directory. (ie. full access rights) However, when
DNET creates an object in the directory the data rights are inherited by the
object, but the object management rights are not.

If I use the QDLS file system, there are no security issues like this, but the
user is restricted to DOS file system naming (8.3), which is not acceptable.

I have tried using the QOpenSys file system, but Windows doesn't like it.

This problem seems to be related to the /root file system.

Syd Nicholson.



Evan Harris wrote:

> I'm willing to bet that the owner of the directory containing the file has
> no authority to the directory.
>
> Creation of a file in the IFS does not automatically grant the owner all
> rights as it does in QSYS.LIB, rather the new file is created granting the
> owner explicit rights to the file that are the same as the rights the owner
> of the directory has to the directory.
>
> What this means in your case is that the creating user gets all the data
> rights at creation time but as the owner of the directory has no rights to
> the directory it receives no additional (management) rights to the file.
>
> Of course, this is only the most likely scenario from my experience - the
> IFS authority schemes behave differently depending on where the file comes
> from/how it is put into the IFS.