RE: Installing running applications as QSECOFR

Queue John Earl :)

You just knew it was coming didn't you David :)

jte
--

John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx




Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.

===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of David Gibbs
Sent: Tuesday, April 01, 2008 1:46 PM
To: Midrange Systems Technical Discussion
Subject: Re: Installing running applications as QSECOFR

Joe Pluta wrote:

I would argue that you don't need QSECOFR for most

operations. If the

product is required to adopt authority of profiles, it

would be just

as easy to grant *USE authority to those profiles which it

needs to adopt.

There is rarely a need to have QSECOFR rights.

In the case of SCM products, the authority REALLY is needed
... because they have to be able to _manage_ the authorities
of the code they are moving around. It's hard to manage the
(often vastly differing) authorities of other code unless you
have adequate authority. In these cases, QSECOFR authority
is a necessity.

In the case of MKS Implementer, we a very strong security
mechanism that protects any program that has to adopt higher
authority from misuse.

Mind you, when Implementer is not actually moving code
around, it is still adopting authority ... but the profile is
a single 'product owner'
profile that has very limited capabilities (by default).

In those rare cases where it might be required, what I'd

like to see

is something like su in Linux, where you would have to key in the
QSECOFR profile to execute a particular function.

Queue John Earl :)

david
(who works for MKS in addition to running these lists)

--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L) mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting,
please take a moment to review the archives at
http://archive.midrange.com/midrange-l.