Re: Restricting RUNQRY interactive

["John Earl" <john.earl@xxxxxxxxxxxxxxxxxx>]

By adding a validity checker to an IBM command you change that IBM command.
This has the effect of making the command no longer a system domain object -
it is now a user domain object  - meaning the command won't run at QSECURITY
level 40 and higher.

I believe this is why IBM added the new Command Processor Exit Programs - to
allow us to do what we used to do in VCP's when we run at QSECURITY 40 and
higher.

jte

--
John Earl
www.powertechgroup.com  john.earl@powertechgroup.com
The Powertech Group Inc. Seattle, Washington
Where the Security Experts Live!

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--


> I don't know if you are referring to the need to reapply any CHGCMDs when
> upgrading the OS. But can you give a summary of the security problems?
>
> TIA
>
> At 02:20 PM 5/8/02 -0400, you wrote:
>
> >Might I suggest changing the command itself to disallow *INTERACT, *IMOD
> >and *IPGM from the ALLOW parameter.  Adding a validity checker can cause
> >hassles with security.  I used to use that technique, and I have now gone
> >away from it.
> >
> >Al
> >
> >Al Barsa, Jr.
> >Barsa Consulting Group, LLC
> >
> >400>390
> >
> >914-251-1234
> >914-251-9406 fax
> >
> >http://www.barsaconsulting.com
> >http://www.taatool.com
> >
> >
> >We have added a validity checker to RUNQRY. When RUNQRY
> >is run from a command line, the VCP gets called. When
> >you take option 9 from WRKQRY, it does NOT get called.
> >Anyone know why?
> >
> >BTW, option 8 of WRKQRY (Run in batch) does call it.
> >
> >TIA
> >
> >Vern