Re: IFS security problem

Syd

I'm willing to bet that the owner of the directory containing the file has
no authority to the directory.

Creation of a file in the IFS does not automatically grant the owner all
rights as it does in QSYS.LIB, rather the new file is created granting the
owner explicit rights to the file that are the same as the rights the owner
of the directory has to the directory.

What this means in your case is that the creating user gets all the data
rights at creation time but as the owner of the directory has no rights to
the directory it receives no additional (management) rights to the file.

Of course, this is only the most likely scenario from my experience - the
IFS authority schemes behave differently depending on where the file comes
from/how it is put into the IFS.

Hope this helps.

Regards
Evan Harris

>Can anybody help here?
>
>I have a directory in the IFS  - /home/dnet/server - with the following
>authority:
>
>Owner = DNET
>Authorization list DNETAUT
>*PUBLIC  *EXCLUDE data authority, no object management rights
>
>The DNETAUT authorisation list gives DNET and myself *ALL access to
>objects
>
>This directory is exported via NetServer with read/write authority
>
>
>
>User DNET creates an object in /home/dnet/server using a shared
>directory in Windows. All objects created have the following authority:
>
>Owner DNET
>Authorization list DNETAUT
>*PUBLIC *EXCLUDE data authority, no management object rights
>DNET    *RWX data authority, no management object rights.
>
>User DNETcannot move, rename, delete any objects, even though it was
>DNET that created them and DNET is the owner.
>
>The problem is DNET's management object rights - they are none existent.
>If these rights are added manually, or DNET is removed from the list of
>authorities manually, DNET can now manage the object. I need this to
>operate automatically.  I cannot seem to find a way to set up the system
>such that if DNET creates an object, then DNET can also delete it.