Re: Dumb adopted authority question

David Gibbs wrote on 02/22/2005 12:25:35 PM:
> If I am signed on as QSECOFR, and run a program (ILE CL) that is owned
> by a normal user and has USRPRF(*OWNER), what is the programs effective
> authority?  QSECOFR or the users?
>
> I've got a program that is being run as QSECOFR, but the USRPRF value is
> that of a normal user ... the program is failing when it's trying to
> switch profile handles to another *SECOFR profile because it does not
> have *USE authority to QSECOFR.

A process must have *USE authority to a user profile to get a profile
handle for that user profile. If the program will be swapping the process
from a powerful user profile such as QSECOFR to a normal user profile then
that program may not be able to swap back unless it does at least one of
these two things.

1. It adopts its owners authority and the owner has lots of authority.
(*ALLOBJ or *USE authority to the user profile to be swapped to.) This may
not be a good idea because while the process is swapped to the normal user
profile the program will still be adopting lots of authority.

2. The program gets a profile handle for *CURRENT before doing any
swapping. It can then always use that handle to swap back after swapping to
a user profile with little or no authority.

Ed Fishel,
edfishel@xxxxxxxxxx