Re: chgc0100 exit point. was Default for command without default value?

> A user without *AllObj authority codes and creates a chgc0100 exit
pgm.
>
> A profile that does have *AllObj authority runs AddExitPgm to
register the chgc0100 exit pgm.
>
> The exit pgm is then replaced by a user with existance rights to the
exit pgm ( but no *AllObj special authority ).

This is the flaw.

Secure program objects against replacement by not giving users Object
existance rights.  If a user needs to run a program, they need Object
Use rights, no more.  There is no reason that anyone other than "the
controller of produciton objects" to have object existance rights to a
production program.


> The new exit pgm, which runs every time the registered cmd is used,
and runs with the authority of the job that calls it, contains code
that checks to see if the running user has *AllObj/*SecAdm authority.
If so, it ....
>
> You must have *AllObj and *SecAdm to register an exit pgm.  Should
not the exit pgm itself have to be owned by a profile with
*AllObj/*SecAdm ?
>
> Otherwise, careless managing of the exit pgm could result in an exit
pgm running code you dont want it to run.

Careless management of _any_ program could result in code being run
that I don't want.   If I allow anyone to delete a production program,
someone could put a trojan horse in it that lies in wait for *ALLOBJ
authority.  This exposure is not unique to exit programs, it's a
potential problem with every program.

jte



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---