Re: Domain Violation

Jeff,

At 04:33 PM 2/3/98 -0500, you wrote:
>I'm in the process of eliminating 'problems' before changing to security
>level 40.  I have only 1 'problem' left.
>
>There are some users who have dozens of menus available to them.  To
>save time, I set up command "G" with CPP "G".  Essentially it is a
>replacement for the GO command with restrictions on the library names
>that can be used.  I.E., the user could "GO" to an IBM supplied menu,
>but cannot "G" to an IBM supplied menu.
>
>Program G contains the following statement:
>
>       TFRCTL PGM(QUICMENU) PARM(&MNULIB &RTNPT) 
>

A couple of thoughts.  

Have you tried creating your own copy of QSYS/QUICMENU and put it in your
own system library (I often use ZSYS) that is higher on the system library
list than QSYS.  The effect is that QUICMENU is no longer a System Domain
program, and your user domain program is now allowed to call it.  Just
experiment with this... you may get a new 'AF' because your user domain
version of QUICMENU is now calling some other System Domain program, but
it's worth a try.

Another option would be let the users use the GO command, but add a validity
checking program to the GO command.  You could do all your
editing/restricting in the validity checker, and not violate the System
Domain.  Now this isn't foolproof, anyone with a little technical savvy can
usually beat a validity checker, but it's beyond the ken of most end-users
and I suspect that that is who you're trying to foil.  The logic wouldn't be
too terribly different than the logic in your G program, just different output.

The last option is to create a group profile (call it GRPEXCLUDE) and grant
it *EXCLUDE authority to everything in QSYS that is of type *MENU.  Next
make this group a supplemental group for all of your end-users.  This will
keep them all out of all IBM menu's, but it is probably a little higher
maintenance than the other two options.


hth,

jte
--

John Earl       Lighthouse Software Inc.
8514 71st NW    Gig Harbor, WA 98335
253-858-7388    johnearl@lns400.com

Without Lighthouse Network Security/400, your AS/400 is wide open.

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---