RE: Is DFU capability a part of the *ALLOBJ privlidge or can DFUbeseparately denied?

So, implementing an exit pgm will restrick an *allobj user?

<Sigh>

Sorta, until the *allobj user removes the exit program, or changes the
source code of the exit program and recompiles it, or..., or..., or...

*ALLOBJ is power.  It can leap tall buildings in a single bound.  Adding
ankle weights may discourage a few folks, but it doesn't change the
underlying power of *ALLOBJ.

If you want to minimize your exposure to the damage that an *ALLOBJ user
can do, you need to:

-Limit the number of people who have *ALLOBJ,
-Limit the amount of time that any user operates with *ALLOBJ, and
-Regularly Audit and Review the actions of people operating with *ALLOBJ
authority.

You can do those three things manually, or you can write your own
procedure to do those steps, or you can purchase a commercial product
that does it for you.  

What you can't do is grant *ALLOBJ special authority to profile and then
prevent that user from exercising it.

jte