Re: [MI400] How will new system state restrictions work? was: Attention Users of *SYSTEM State

[Keith Carpenter <carpcon@xxxxxxx>]

It may be just as Bruce said, a restriction on the restoration of 
non-IBM system state programs.  Kind of like an internal extension of 
the QVFYOBJRST system value that controls object restoration (can 
restrict user state programs without signatures).  The system value was 
introduced in V5R1.  Object signing may have began earlier (V4R5 ?).

CHKOBJITG might also be changed to report the new violation, but 
verifying signatures at program activation does not seem very practical. 



Keith


Steve Richter wrote:
> -----Original Message-----
> From: mi400-bounces@xxxxxxxxxxxx [mailto:mi400-bounces@xxxxxxxxxxxx]On
> Behalf Of Bruce Vining
> Sent: Monday, March 07, 2005 11:16 AM
> To: MI Programming on the AS400 / iSeries
> Subject: [MI400] Attention Users of *SYSTEM State
>
>
> > Within two years IBM plans to remove the i5/OS ability to restore system
> > state programs not digitally signed by IBM. Only programs provided by IBM
> > will be able to use system state. Any other system state programs will have
> > to be changed to use supported interfaces accessible from user state.
>
>
> So what is the speculation on how "Only programs provided by IBM will be
> able to use system state." will be implemented?  From the statement, there
> will still be a system state.  Will the bit settings in the system object
> header continue to control whether a program runs in system state or not?
> Will SST continue to be used to set those bits?  Is the digital signature
> something new to the system?
>
> -Steve