RE: How can I limit spooled file access under OperationNavigatorUserwith *SPLCTL special authority ?

Rob,

Actually this:
 
> EDTOBJAUT OBJ(MYLIB/MYOUTQ) OBJTYPE(*OUTQ)
> And removed access for *PUBLIC, wouldn't that be more effective?  You
may
> have to modify the
> CHGOUTQ OUTQ(xxxxxx) AUTCHK(???????)

...is not nearly as effect as you would hope.  Because spool file
security does not follow the normal rules of object level security,
removing access to an out queue does not prevent a user with *SPLCTL
special authority from seeing and/or manipulating spooled files on that
queue.  There are a number of methods of accessing the entries on the
queue that don't check a user's authority to the queue itself.  WRKSPLF
USER(JOHN) is the most obvious.

So while your suggestion is appropriate for most OS/400 object types,
and would actually thwart some access attempts (like WRKOUTQ
OUTQ(PRT09)), in the case of spool files, Special Authority trumps
again.

jte



John Earl - john.earl@powertechgroup.com
The PowerTech Group - Seattle, WA 
+1-253-872-7788 - www.powertech.com