Re: Security question -- MIDRANGE-L

Hello Kenneth,

Aside from the fact that "users" should not have access to a command line while 
adopting 
&deity. authority ...

Method 1 makes the job appear to run as the requested profile.  Any associated 
group profiles 
are included in the authority check.  The original job profile is no longer 
used in authority 
checks.  Objects created after the call to QWTSETP will be owned by the new 
profile.  Note 
that the job name will not be changed, just the profile associated with the job.

Method 2 just adopts the authority.  Authority checks are done using the job's 
profile and the 
owner's profile; the owner's group profiles are not used.  Objects will still 
be owned by the 
real job profile. 

Also calling QSYGETPH with the special value of *NOPWD requires *USE rights to 
the specified 
profile and that is all that is required to create a program which adopts that 
users authority 
so you may be creating a security hole even if you don't present a command line.

Both methods are dangerous from a security standpoint.

Regards,
Simon Coulter.

//----------------------------------------------------------
// FlyByNight Software         AS/400 Technical Specialists
// Phone: +61 3 9419 0175      Mobile: +61 3 0411 091 400
// Fax:   +61 3 9419 0175      E-mail: shc@flybynight.com.au
// 
// Windoze should not be open at Warp speed.
 

//--- forwarded letter -------------------------------------------------------
> X-Mailer: Mozilla 4.04 [en] (Win95; U)
> Date: Fri, 10 Apr 98 13:26:45 -0700
> From: "Kenneth E. Graap" <kgraap@clackesd.k12.or.us>
> To: "midrange-l@midrange.com" <midrange-l@midrange.com>
> Reply-To: MIDRANGE-L@midrange.com
> Subject: Security question

> 
> Midrangers....
> 
> What, if any, difference is there between the following two methods of
> giving a user access to a command screen with QSECOFR authority:
> 
> Program #1 - API method... 
> 
> Owner  . . . . . . . . :   QSECOFR 
> User profile . . . . . :   *USER 
> 
>  DCL        VAR(&PRFHDL) TYPE(*CHAR) LEN(12)  
>                                                             
>  CALL       PGM(QSYGETPH) PARM('QSECOFR   ' '*NOPWD    ' +  
>               &PRFHDL)                                      
>  CALL       PGM(QWTSETP) PARM(&PRFHDL)                      
>  CALL       PGM(QCMD)                                       
>  
> Program #2 - Program authority adoption method
> 
> Owner  . . . . . . . . :   QSECOFR 
> User profile . . . . . :   *OWNER
> 
>  CALL       PGM(QCMD)
> 
>  
> Kenneth                 
>                                                             
> -- 
> * *************************************** *
> Kenneth E. Graap               
> Coordinator - Network Operations Center 
> Clackamas Education Service District   
> PO 216 / Marylhurst,  OR  97036-0216   
> 503 635 0551        FAX 503 635 0578 
> 
> "Dedicated to Excellence Through 
>     Leadership and Service"  
>  
> kgraap@clackesd.k12.or.us 
> http://www.clackesd.k12.or.us/~kgraap       
> * *************************************** *

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---