Re: *SAVSYS vs Granting authority to an object owner

Ed,

Thanks for the heads up.  Turns out they could also change the owner of a 
program to be this user profile.  And since this user profile has *ALLOBJ 
the program, in theory, could be as simple as UPDDTA PAYLIB/PAYDATA.

I'll be happy when thing are cleaned up and *ALLOBJ is removed from this 
user.

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 




"Ed Fishel" <edfishel@xxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
04/10/2003 03:13 PM
Please respond to Midrange Systems Technical Discussion
 
        To:     Midrange Systems Technical Discussion 
<midrange-l@xxxxxxxxxxxx>
        cc: 
        Fax to: 
        Subject:        Re: *SAVSYS vs Granting authority to an object 
owner



Rob,

>I think I have a workaround.
>GRTOBJAUT OBJ(EDIONR) OBJTYPE(*USRPRF) USER(thisuser) AUT(*OBJOPR *ADD)

Check the "Commands Common for Most Objects" table in Appendix D of the
Security Reference manual and you will see that you only need to give the
user *ADD authority to a user profile to allow then to restore objects 
that
will be owned by that user profile.

>Any potential security breaches with this solution?

There are things to consider. The user can now use CHGOBJOWN, CHGOBJPGP,
RSTOBJ, and CRTxxx with REPLACE(*YES) to cause objects to be owned by the
user profile to which they have *ADD authority. This could be used to 
cause
problems for someone else if their user profile has a maximum storage
allowed limit. It could also be used to avoid someone's own limit by
causing their objects to be owned by someone else. Letting someone change
the primary group of an object could also mess up your security design.

By itself, this should not be a problem for programs that adopt their
owners authority. See the "Objects That Adopt the Owner's Authority"
section of Chapter 5 of the Security Reference Manual for more 
information.

Ed Fishel,
edfishel@xxxxxxxxxx



_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.