RE: _C_IFS_FOPEN

Was not planned but the way the directories evolved.  Programmers
started creating files for their programs to pull together and merge in
to complex documents.  Users never need to see the structure underneath
the document generation but the job has to be able to read all the
files.  The job use to run under a profile with *allobj and I wanted to
change that.  Now that I know how the directory structure works and what
authorities are needed. I will be updating our IFS security and
educating our programmers to use the right directories and set
authorities correctly.  I cannot find the IFS authority stuff under
public documents but someone else found it under Partner World.  We are
an end user with in-house programming so we do not qualify for Partner
World.  Been turned down every year for the past 5 that I have tried.
Now that this thread is in Midrange Archives, hopefully others can find
the answers.


Christopher Bipes

IS Director

CrossCheck, Inc. 

707.586.0551, ext. 1102

707.585.5700  FAX

Chris.Bipes@xxxxxxxxxxxxxxx
www.Cross-Check.com



Notice of Confidentiality: This e-mail, and any attachments thereto, is
intended only for use by the addressee(s) named herein and may contain
legally privileged and/or confidential information.  If you are not the
intended recipient of this e-mail, you are hereby notified that any
dissemination, distribution or copying of this e-mail, and any
attachments thereto, is strictly prohibited.  If you have received this
e-mail in error, please immediately notify me by e-mail (by replying to
this message) or telephone (noted above) and permanently delete the
original and any copy of any e-mail and any printout thereof.  Thank you
for your cooperation with respect to this matter.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Friday, November 25, 2005 11:40 AM
To: Midrange Systems Technical Discussion
Subject: Re: _C_IFS_FOPEN


> Well I created a test program to see what authorities are needed to 
> open a file for read only.  Turns out that the file is not the 
> problem, but the directory.  While the users had read access to the 
> directory, they did not have *RX.

Why would you give users *R access but not *X access to a directory? 
Doesn't make any sense to me.  You want the users to be able to read the
list of filenames, but not be able to use them?

> So to use the IFS, the users need *RX to the directories and *R to the

> file for read only.

Yep.


> To create a file users will need *RWX to the last directory in the 
> path and *RX to the directories above.

Yep.

> I want to thank everyone for their incites and URLs to the 
> documentation.  No where I read did it say you need *RX to the 
> directory containing the file in which you want to read.  Argh!

Hmmm... I've read that several times, though I can't remember where. I
didn't realize that it was the problem you were encountering.  Sorry, I
should've suggested that possibility when you first brought it up.