CHGSYSLIBL and Security

["Richard B Baird" <rbaird@xxxxxxxxxxxxxxxxxxxxx>]

I found this in the archives...

>> Subject: Adding a library to the system's  library list
>>
>> CHGSYSLIBL only changes the System Library list of the current job.
>> You would have to use this command for every user every time they
>> signed on.
>>
>> Also, in order to execute a CHGSYSLIBL you need *ALLOBJ authority.
>> jte

> Hello John,
> That's not completely true.  Althought the CHGSYSLIBL command is
> shipped with *EXCLUDE authority, any *ALLOBJ user can change the
> public authority to a less restrictive value, or grant specific
> authority to a user.

> All that CHGSYSLIBL requires is *USE authority to the command,
> *USE authority to the library being added, and *EXECUTE
> authority to QSYS.

> There are security considerations involved in relaxing the authority to
> this command.

I'm kinda in the same boat.  A client i'm working for has a couple of
production (file and program) libraries in the system library list (not
recommended, but they are reluctant to change)

This makes for a real hassle when trying to test changes to these.  I end
up having to hard code library names for calls and file overrides.  It
would be nice to slip a test library above these for testing.

I don't have all of the authorities I need to use the command, and rather
than ask for this specific authority - I was wondering - can't someone WITH
all these authorities compile a program that does a CHGSYSLIBL, using adopt
authority, and then give me authority to this program?

Thanks,

Rick