Re: CPYFRMSTMF, adopted authority and QSYGETPH

CRPence schreef:

Is that new outcome\restriction listed in the Memo to Users? If not, request a PTF, because that new restriction was apparently unplanned.... and it will surely affect many more.

Sort of. In a discussion with IBM the answer we got was 'The IFS developer said that the this situation is a direct result of the re-write they did in V6R1 for CPYFRMSTMF and CPYTOSTMF. There is an item in the Memo to Users about this, though it doesn't mention adopted authority specifically. It mentions changed authority restrictions for both commands, and how they made the change to be more consistent with the CPY command. This is one of the effects of that. The previous release code allowed the adopted authority to work because no IFS interfaces were actually being used to access the database file, even though we required the user to specify an IFS pathname. In V6R1, we are using IFS interfaces to access the database file also, and so the adopted authority is not used.'

Do not confuse /Use Adopted Authority/ with USER(*OWNER). The former requires the calling program [with the API as callee] to adopt necessary authority to access the user profile. The latter would enable any user authorized to the API to access any user profile authorized to the owner of the API; as QSYS, that would be a huge security hole.

Apparently I was unclear about that. I check the call stack for programs with USER(*OWNER). But I also check for USEADPAUT, because *NO 'breaks the chain', so to speak. That is why I checked *PGM object QSYGETPH; its behaviour suggested USEADPAUT(*NO).

Joep Beckeringh