Re: Preventing users from RUNQRY Interactively

"Randy Robb" <rwrobb@pbsilink.com> wrote:

>Many, if not most, AS/400's have QSYS defined as part of the system value
>QSYSLIBL.

All do. QSYS cannot be removed from the system portion of the library list, or
from the system value QSYSLIBL.

>    The "rub" here is that you can't add a library in front of any library in
>the SYS portion of your library list.

Yes you can. The CHGSYSLIBL command can be used to add a library to the top of
the system portion of the library list or remove it from the system library
list. The exception is that QSYS can neither be added nor removed.

>    A possible solution is to move QSYS to the system value QUSRLIBL.

No, not a possible solution. You cannot add QSYS to QUSRLIBL because it
duplicates an entry in QSYSLIBL. You cannot add QSYS to the user protion of a
job's library list because it duplicates a library list entry.

Many shops create a library for modified IBM commands and place this above QSYS
in the system value QSYSLIBL. This is the standard solution. You should ensure
that *PUBLIC does not have *CHANGE authority to this library. Note that this
does not prevent a user with command line access from running the unmodifed
command by speciying, for example, QSYS/RUNQRY.

Dave Kahn, ABB Steward Ltd.


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---