Re: *OWNER authority objects

On 11/26/10 11:46 AM, James H. H. Lampert wrote:

We have a number of customers where restoring a *PGM with *OWNER
authority is permitted, but the *PGM is immediately set to
PUBLIC(*NONE).

Anybody remember off-hand what controls this? QALWOBJRST looks like
it would either allow restoration or just block it outright.

While QALWOBJRST can play a role in preventing restore, there are specific rules for the restore of programs that are both eligible for restore and "adopt authority".

From the security reference at the link above (which positions to "Restoring Programs" heading), the following text from there, gives an explanation of the described effect.

Restoring Programs That Adopt the Owner's Authority:

When a program is restored that adopts owner authority, the ownership and authority to the program may be changed. The following applies:

* The user profile doing the restore operation must either own the program or have *ALLOBJ and *SECADM special authorities.
* The user profile doing the restore operation can receive the authority to restore the program by
o Being the program owner.
o Being a member of the group profile that owns the program (unless you have private authority to the program).
o Having *ALLOBJ and *SECADM special authority.
o Being a member of a group profile that has *ALLOBJ and *SECADM special authority.
o Running under adopted authority that meets one of the tests just listed.
* If the restoring profile does not have adequate authority, all public and private authorities to the program are revoked, and the public authority is changed to *EXCLUDE.
* If the owner of the program does not exist on the system, ownership is given to the QDFTOWN user profile. Public authority is changed to *EXCLUDE and the authorization list is removed.

Regards, Chuck