Installing running applications as QSECOFR ( was RE: Anti-virus for i5OS )

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
bounces@xxxxxxxxxxxx] On Behalf Of ALopez@xxxxxxxxxx
Sent: Tuesday, April 01, 2008 3:04 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Anti-virus for i5OS


I read statements like this and shrug my shoulders. Do you refuse to use
TAATOOL because it requires installation as QSECOFR? So much the worse
for you.

Yep, or if I really need it, I install it without QSECOFR and call the vendor if it breaks.

Requiring installation user QSECOFR is 99% of the time the vendor taking the easy way out. That
worked in the past, today it doesn't fly.

Does your change management software install as QPGMR? If so, how does it
promote software to production level, which presumably is run as something
other the QPGMR? If your change management software can truly control
what gets moved into production, what difference does it make whether it's
installed as QSECOFR or not? It already has access to the very reason for
having the system.

IIRC, you created a CMSPROFILE, for the application to use; and installed the application using that
profile.

Promotions run under the CMS profile, which have *ALL authority to any object managed by the CMS.

The CMS profile certainly doesn't have *ALLOBJ, though we used to give it that till SOX came around.

Thus, the CMS can do everything it needs to do, but doesn't have the authority to do anything more.

Even more questionable: if I install IBM's Advanced Scheduler, I do so as
QSECOFR since it's "part of the operating system". If I choose to use
Robot, I shouldn't install it under QSECOFR because it isn't? They both
do the same thing. What's the difference?

The difference, is one could be fiddling with the OS under the covers, while the second can't
(shouldn't) be since it isn't an IBM provided program.

I'll certainly agree that too many packages run under faulty security
schemes. But saying that you won't install anything other than the
operating system as QSECOFR either limits the usefulness of your system or
is completely disingenuous.
--

Charles Wilt


This e-mail transmission contains information that is intended to be confidential and privileged. If you receive this e-mail and you are not a named addressee you are hereby notified that you are not authorized to read, print, retain, copy or disseminate this communication without the consent of the sender and that doing so is prohibited and may be unlawful. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please delete and otherwise erase it and any attachments from your computer system. Your assistance in correcting this error is appreciated.