Re: Is DFU capability a part of the *ALLOBJ privlidge or can DFUbe separately denied?

Yes.  Until they remove the exit point.  So, secure the exit point 
commands with the same exit point.
?Frank? look at it like this; let's say I have a dummy command prompt at 
the bottom of a screen.  And you, as an *ALLOBJ user, enters the command 
DLTF.  Now, since it is a dummy command line, I can take that command, 
scan for a file that I don't want you to delete, and echo back "no 
flipping way".  People often do this with a dummy command line and the 
QCAPCMD api.
Now, imaging that this "dummy command line" logic extends to all uses if 
that command.  Be it in a program, real command line, buried in a ftp 
script, whatsofreakingever.  You can then use the command exit point 
program and do whatever you want.  Like, if they enter SIGNOFF, on the 
first Tuesday of the year, I'll run the command CLRLIB PAYROLL instead. 
(wait, bad example).  Better example, if they enter UPDDTA 
PAYROLL/PAYRATE, you send an email to the pager worn by the armed security 
guard.

Rob Berendt