RE: Using QCMDEXC in an SQL SELECT statement Was: Disabled User Profiles

[rob@xxxxxxxxx]

Paul,

Do not rely upon "security by obscurity".  Creating QCMDEXC as a function 
is not a security breach.  If you do not have access to DLTUSRPRF you 
still cannot run it by using the User Defined Function (UDF) QCMDEXC.  The 
only thing that the function does is allow you to run it easier.  We 
created is as a function for the myriad of CL programs we had written that 
basically did
DSP... OUTPUT(*OUTFILE) ...
DCLF ...
READ:
  RCVF 
  MONMSG     MSGID(CPF0864) EXEC(GOTO CMDLBL(EOF))
  /* Do something */
  GOTO       CMDLBL(READ)
EOF: 
EXIT: 
ENDPGM

Is the ability to write a CL program a security breach?  Should that be 
something that antivirus programs should stop?  By default anyone can 
write a CL program.  You do not need the application tools on your system. 
 All systems have EDTF and CRTCLPGM.  If you find the SQL UDF a security 
breach because it can be used to run DLTUSRPRF then I suggest you stop 
giving all your users *SECADM and *ALLOBJ.  That's a step in the right 
direction.

Is having the UDF a breach because it doesn't slow down the developer and 
make him think?  Then, by all means, let's put other impediments in his 
path.  Let's ban CL and force them to use MI.  After all, did you see 
anything in the CL sample above that did any comparison?  What was to stop 
this CL program from forgetting the "where" and deleting all user 
profiles?


Rob Berendt