RE: QCAIEXIT, QMHRTMSS vs QMHRCVPM -- MIDRANGE-L

I think I can duplicate it now.

Start a 5250 session with a user with low access.
Debug that session using the CODE/400 debugger.
Have the 5250 session generate the error.  It gets lots of
Attempt to use permanent system object QCADRV2 without authority.
Attempt to use permanent system object QCANPARS without authority.
Attempt to use permanent system object QCARULE without authority. 
Attempt to use permanent system object QCAPOS without authority. 
Attempt to use permanent system object QCAFLD without authority. 
Attempt to use permanent system object QCACALL without authority. 
Attempt to use permanent system object QWCSCVTR without authority.
Attempt to use permanent system object QWCSCVDR without authority.
Attempt to use permanent system object QWCSRTAR without authority.
Attempt to use permanent system object QCAIEXIT without authority.
Attempt to use permanent system object QMHRTMSS without authority.
Attempt to use permanent system object QTQGETCC without authority.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





rob@xxxxxxxxx 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
02/24/2005 01:56 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: QCAIEXIT, QMHRTMSS vs QMHRCVPM






Only authority stuff documented is:

Authorities and Locks
>> Message File Authority 
*USE, if receiving a predefined message and the message file used when the 

message was sent was deleted and recreated.


Message File Library Authority 
*EXECUTE, if receiving a predefined message and the message file used when 

the message was sent was deleted and recreated.  <<

If that was my issue, wouldn't the joblog indicate the message queue in 
error, and not all those IBM programs?

I assume that the >>    << stuff indicates something new, or modified, in 
V5R3?

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





Bruce Vining <bvining@xxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
02/24/2005 01:44 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: QCAIEXIT, QMHRTMSS vs QMHRCVPM










If you meet the authorization requirements documented by the API then you
should not need any additional authorities.  I don't know what might be
going on (you aren't inadvetently running some custom version of QMHRCVPM
are you?), but giving yourself private authorizations to those two objects
is not the right solution.

Bruce Vining



 
             rob@xxxxxxxxx 
             Sent by: 
             midrange-l-bounce                                          To 


             s@xxxxxxxxxxxx            Midrange Systems Technical 
                                       Discussion 
                                       <midrange-l@xxxxxxxxxxxx> 
             02/24/2005 12:05                                           cc 


             PM 
                                                                   Subject 


                                       RE: QCAIEXIT, QMHRTMSS vs QMHRCVPM 
             Please respond to 
             Midrange Systems 
                 Technical 
                Discussion 
 
 




Seems rather silly to have to adopt authority simply to use the receive
message api.
No, it doesn't have access to some of the objects mentioned in the joblog.
 The fact that it needs them for this api, and they come secured that way
is a situation IBM needs to handle - IMNSHO.

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Gary Monnier" <gary.monnier@xxxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
02/24/2005 12:56 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: QCAIEXIT, QMHRTMSS vs QMHRCVPM






Rob,

I know you probably already looked at this but does the program with the
RPG line of code have enough authority to execute the objects in
question?  You may want to change it to have a user profile of *OWNER
and be owned by a profile that does have enough authority to execute all
the objects in question.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Thursday, February 24, 2005 6:28 AM
To: midrange-l@xxxxxxxxxxxx
Subject: QCAIEXIT, QMHRTMSS vs QMHRCVPM


This line of RPG
 qmhrcvpm(rcvm0200:%len(rcvm0200):'RCVM0200':'*':StackCnt:'*PRV':
                    MsgKey:0:'*SAME':ERRC0100);
is generating:
MCH1001-Attempt to use permanent system object QCAIEXIT without
authority.
MCH1001-Attempt to use permanent system object QMHRTMSS without
authority.

Both have the identical:
>From program . . . . . . . . . :   #auexcpt
  Instruction  . . . . . . . . :     000B80

To program . . . . . . . . . . :   QQDAPROC
  To library . . . . . . . . . :     QSYS
  Instruction  . . . . . . . . :     05E4

WRKPTFGRP
PTF Group             Level  Status
SF99530                5032  Installed
SF99529                  38  Installed
SF99503                   3  Installed

Both objects mentioned have *public *exclude.  Since they are IBM
objects
I just don't want to change them willy-nilly.
I've searched the cover letters for qmhrcvpm.  I have the only one
mentioned.  (Hope the fact that it was a delayed ptf doesn't mean that
if
I need a fix, it too will be delayed.)
No hits on the two objects.  No hits on QQDAPROC.  The website does not
support searching for #auexcpt.
http://www-912.ibm.com/a_dir/as4ptf.nsf/521270d71840f65886256e7700697c8c
/$searchForm?SearchView

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.



-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.