RE: IFS security problem

Here are the rules.....

The new objects owner will always be the user that created the object.

The new object's owner has the same object authority as the parent
directory's owner.

The new objects primary group has the same object authority as the parent
directory primary group

The new object's public has the same object authority as the parent
directory's public.

Authorization lists are inherited from the parent directory.

A user requires Unix " W " authority to a directory + OS/400 *OBJEXIST
authority to the directory in order to add or remove objects from a
directory, regardless of authority to the object.

Kenneth

****************************************
Kenneth E. Graap
IBM Certified Specialist
AS/400e Professional System Administrator
NW Natural (Gas Services)
keg@nwnatural.com
Phone: 503-226-4211 x5537
FAX:    603-849-0591
****************************************


-----Original Message-----
From: Syd Nicholson [mailto:sydnic@ccs400.com]
Sent: Wednesday, July 17, 2002 3:40 PM
To: midrange-l@midrange.com
Subject: Re: IFS security problem


*This message was transferred with a trial version of CommuniGate(tm) Pro*
Thanks Evan,

The owner of the parent directory is DNET, defined with both data AND object
management rights to this directory. (ie. full access rights) However, when
DNET creates an object in the directory the data rights are inherited by the
object, but the object management rights are not.

If I use the QDLS file system, there are no security issues like this, but
the
user is restricted to DOS file system naming (8.3), which is not acceptable.

I have tried using the QOpenSys file system, but Windows doesn't like it.

This problem seems to be related to the /root file system.

Syd Nicholson.