RE: Security Routines - bind by copy? (wasRE: Questionabout serviceprograms)

David,

Crispin's post about it being more pertinent to vendor code than homegrown code finally made the light
go on.

I can see where you're coming from now <grin>.

On the other hand, seem like now-a-days at least, there other ways such as object signing to insure
that you're running your own code.

Then again, probably not a big issue for you to recompile the world when something changes.

Charles Wilt
--
Software Engineer
CINTAS Corporation - IT 92B
513.701.1307

wiltc@xxxxxxxxxx

-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx [mailto:rpg400-l-bounces@xxxxxxxxxxxx]
On Behalf Of David Gibbs
Sent: Friday, August 01, 2008 11:13 AM
To: RPG programming on the AS400 / iSeries
Subject: Re: Security Routines - bind by copy? (wasRE: Questionabout
serviceprograms)

Wilt, Charles wrote:

It would seem to me that if you have the authority to replace the
security *SRVPGM in it's entirely...then you'd probably have the
authority to do whatever you want anyway.

Perhaps, but that's a different problem entirely.

Of course, hard coding a service program reference might have
ramifications in itself ... especially if you are deploying code to
multiple locations with differing configurations. I would say that few
service programs are fully qualified when they are bound in.

Besides, couldn't the *MODULE object that get bound into programs be
replaced just as easy? Granted, it'd only affect recompiled programs
and not all existing.

Which pretty much defeats the purpose. The goal of someone who would do
this is to substitute their own code at run time. There's no reason at
all for a module to be deployed to a production system.

david

This e-mail transmission contains information that is intended to be confidential and privileged. If you receive this e-mail and you are not a named addressee you are hereby notified that you are not authorized to read, print, retain, copy or disseminate this communication without the consent of the sender and that doing so is prohibited and may be unlawful. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please delete and otherwise erase it and any attachments from your computer system. Your assistance in correcting this error is appreciated.