Re: Securing a command from command line.

You could put PUBLIC *EXCLUDE on the command. In programs that need to use
it, adopt enough authority.  Depending on what the program does, you could
create a new user profile (no password) that owns the command and has no
authority to anything else. The program that uses it would adopt the
authority of that user profile.

There is no way to really limit QSECOFR.  By definition QSECOFR has
authority to everything.  There is a capability on OS400 called "Limit
Function Usage" that can be used to limit QSECOFR. This is what the iNav
Application Administration interface uses too. You define a "function" (I
think of them as roles actually), and then you can allow or deny access to
the function. It has an option to "ignore *ALLOBJ" authority.

But you would still have to write your own program to wrapper the command
and make sure it got called instead of the real command.  Your program
would use the "check function usage API" and exit if the caller was not
allowed.

As of V5R2 there are also a set of FCNUSG commands (WRKFCNUSG, I think)
that you can use to manage who's allowed and denied and create new
functions (aka roles in my mind).

See the information center for more info on the commands and APIs. Also
check out Application Administraton in iNav to see what options are
available. As I recall, if you define a new function, then you can manage
it in iNav or through the green screen. I don't think you can create
functions in iNav.

Patrick Botz

midrange-l-bounces@xxxxxxxxxxxx wrote on 03/10/2005 01:34:04 PM:

> I want people to not use a certain command from the command line but
using
> it in a program is ok.  I even want to restrict QSECOFR so LMTCPB is not
> the option.  First thought was CHGCMD and take away *INTERACT.  However,
> that killed the use in a program.  I thought *IPGM was all I needed.
> However *IPGM is pretty insistent that the program be a CLP.  Trying the
> command with QCMDEXC in RPGLE blows up after you remove *INTERACT.