Re: CHGQRYA and *JOBCTL authority

[John Swartzendruber <johnbs@xxxxxxxxxxxxxx>]

Boy, you must be reading thru some old mail!

Your suggestion was what we implemented, and it works.

Vernon Hamberg wrote:

> John
>
> Did you get a reply to this? Just found some old posts.
>
> At 03:12 PM 1/22/98 -0000, you wrote:
> >How do other shops deal with the fact the *JOBCTL authority is needed on a
> user
> >profile in order to run the CHGQRYA command?  It's become an issue because
> of MS
> >Access applications using ODBC to access data on our v4r1 system, and
> >automatically attempting to execute this.  I like the fact that a process
> is set
> >up to prevent runaway queries from the PC, but I don't care for IBM's
> >implementation requiring *JOBCTL rights.
> >
> >Am I just being overly stingy with authority, or is this an issue for other
> >shops as well.  Has anyone come up with a workaround?
>
> You _might_ be stingy as fas as *JOBCTL is concerned. We don't limit this,
> AFAIK. Instead, we make sure users can't have command line, which, I think,
> addresses some issues. I mean, users can only affect their own jobs, since
> can't get at others.
>
> Nonetheless, there can be reasons to pull things in. So, maybe write your
> own CHGQRYA command that is owned by something with *JOBCTL, have its CPP
> be owned by the same profile and have USRPRF(*OWNER), and have the command
> with *USE for your other users. Your version would end up calling the
> system's CHGQRYA.
>
> This is just from the hip. Maybe the system qualifies the use of the
> CHGQRYA command. Maybe there are other issues.
>
> HTH
>
> Vernon Hamberg
> Systems Software Programmer
> Old Republic National Title Insurance Company
> 400 Second Avenue South
> Minneapolis, MN  55401-2499
> (612) 371-1111 x480



--

John Swartzendruber
Mennonite Mutual Aid, Inc
johnbs@mma-online.org


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---