RE: RE: RE: Special authority use ... Auditing

Mark:

While saving data is a perfectly reasonable operation within an application, 
I'm not clear why it would require *SAVSYS for the application user. *SAVSYS 
reaches far beyond any application to objects that a user should not be saving. 
And certainly not restoring.

A general rule might be stated as "He who can save an object, can restore the 
object." That can be a very real risk when some system objects are included.

Tom Liotta

midrange-l-request@xxxxxxxxxxxx wrote:

>   7. RE: RE: Special authority use ... Auditing (M. Lazarus)
>
>  I have developed an application that allows users to save subsets 
>of data into *SAVFs and restore them on demand.
>
>At 3/24/06 07:35 PM, you wrote:
>>midrange-l-request@xxxxxxxxxxxx wrote:
>>
>> >   8. RE: Special authority use ... Auditing (Graap, Ken)
>> >
>> >The question I'm trying to answer now is "Why do regular application
>> >uses require *SAVSYS authority?" None of the developers in my shop can
>> >answer that question. I need to understand that before I remove this
>> >special authority from the application's group profile. I was hoping
>> >that I could get information from the audit journal regarding this. It
>> >looks like it isn't going to be that easy. I'll probably end up
>> >recommending that we make the change, see what "breaks" and then address
>> >each situation as it comes up.
>>
>>
>>I'd expect that to be the best course to take. I'm having a very 
>>hard time grasping why any application users would ever need 
>>*SAVSYS. If something breaks, then that something needs to be fixed 
>>-- and _not_ by granting *SAVSYS.