submitting jobs under another profile was: Adopted authority vs profile switching

If you are running in a level less than seclvl(40) then all you have to do
is find a job description out there that has a user profile associated with
it that has *allobj (doesn't need *secadm).
Then you can do this:
SBMJOB CMD(SBMJOB CMD(CHGUSRPRF USRPRF(MYUSRPRF) SPCAUT(*ALLOBU *SECADM))
USER(QSECOFR)) JOBD(soupedup)
All your user profile needs is access to that job description.  The system
won't let you build it yourself though.


Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com


|-----------------------------+-------------------------------------------|
|   Scott Klement             |                                           |
|   <midrange-l@xxxxxxxxxxxxxx|                                           |
|   om>                       |                                         To|
|   Sent by:                  |                                     Midran|
|   midrange-l-bounces@midrang|                                     ge    |
|   e.com                     |                                     System|
|                             |                                     s     |
|   07/22/2004 11:30 AM       |                                     Techni|
|                             |                                     cal   |
|         Please respond to   |                                     Discus|
|         Midrange Systems    |                                     sion  |
|       Technical Discussion  |                                     <midra|
|      <midrange-l@xxxxxxxxxxx|                                     nge-l@|
|                m>           |                                     midran|
|                             |                                     ge.com|
|                             |                                     >     |
|                             |                                         cc|
|                             |                                           |
|                             |                                    Subject|
|                             |                                     RE:   |
|                             |                                     Adopte|
|                             |                                     d     |
|                             |                                     author|
|                             |                                     ity vs|
|                             |                                     profil|
|                             |                                     e     |
|                             |                                     switch|
|                             |                                     ing   |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|-----------------------------+-------------------------------------------|







> Am I reading this right?  Joe User can sign on with his profile, use some
> magic command, and he can become QSECOFR?  With no trace back to Joe
> User's profile?

This is only if the user has *USE authority to the user profile.  Your
users don't have *USE authority to QSECOFR, do they?!

A user with *USE authority to QSECOFR can run the following command and it
will succeed:

ADDJOBSCDE JOB(TEST) CMD(CHGUSRPRF USRPRF(MYUSRPRF) SPCAUT(*ALLOBJ
*SECADM)) FRQ(*ONCE) USER(QSECOFR)

Now that they've got *ALLOBJ and *SECADM authority, they can do anything
they want.

And all of this is possible without profile switching!

If you don't have *USE authority, then you have to know QSECOFR's password
to use profile switching.  If you know the password, you'd be able to log
on as QSECOFR directly and the ability to switch wouldn't matter much!

In reality, the scary part would be someone who has *USE authority to
QSECOFR!!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.