Re: Is DFU capability a part of the *ALLOBJ privlidge or can DFUbe separately denied?

So, implementing an exit pgm will restrick an *allobj user?   
 
 
-----Original Message-----
From: rob@xxxxxxxxx
To: midrange-l@xxxxxxxxxxxx
Sent: Wed, 3 Jan 2007 1:38 PM
Subject: RE: Is DFU capability a part of the *ALLOBJ privlidge or can DFUbe 
separately denied?


Not always.  You can change a system value and even QSECOFR couldn't use 
5250 terminals that they do not have explicit access to.  However, once 
they get in they can then grant themselves authority to those other 
terminals.  WRKSYSVAL QLMTSECOFR.

Another option.
Use the command exit point program.  With that you can secure the usage of 
any command.  I use it to change the execution of SNDDST to SNDEMAIL.
Study these:
WRKREGINF

                      Exit 
Exit                  Point 
Point                 Format    Registered  Text 
QIBM_QCA_CHG_COMMAND  CHGC0100     *YES     Change command exit programs 
QIBM_QCA_RTV_COMMAND  RTVC0100     *YES     Retrieve command exit program

Rob Berendt