Re: Is DFU capability a part of the *ALLOBJ privlidge or can DFU be separately denied?

The ideal way is to forget trying to lock the shitload of commands, (and 
access points like FTP) that can be used to manipulate data.  Instead, 
secure the data and then make all access be via programs that adopt 
authority.

However if you want to appease the auditors (who don't give a rip about 
effectiveness but just work from a standard audit script) then you could 
secure the command STRDFU.
WRKOBJ STRDFU
I'd suggest using an authorization list.  That way you can secure the 
gamut of these commands with one thing.  When you need to open it up for 
one more person, you just need to modify the authorization list and not 
all the objects in question.

See also:  UPDDTA, CHGDTA, etc

Rob Berendt