Re: Giving *SERVICE special authority to developers on production machine

Funny, I am just looking at this here - where we have only *USE authority to programs at production level on our development LPAR. Anything we create in our development libraries, no problem.

So I looked up *SERVICE special authority - it's not needed for STRSRVJOB that I can tell - the requirement there is that you have *USE to the user profile of the job user.

*SERVICE lets you use STRSST and do some traces. And it lets you debug programs without needing *CHANGE authority to the programs.

Taking access to STRSST away is not hard, and the InfoCenter article says that traces can be authorizes using function usage commands. You don't need *ALLOBJ, which was mentioned there.

So that's all I know right now - hope it makes sense.

Vern

On 9/25/2013 8:47 AM, rob@xxxxxxxxx wrote:

I understand the general concept of not giving developers access to
*SERVICE special authority on a production machine. That is, they could
use the graphical debugger (which uses STRSRVJOB under the covers) to
debug a production program, change a running variable, and monkey around
with data ( eval netpay=999999.99). Knowing this, is there other reasons
not to give them *SERVICE authority? Like, "I read how to stop/start
parity protection and wanted to try stopping it to see if it improved
performance"?

We already do not give them *ALLOBJ. One, for security reasons. Two,
stops some of the "gee, it works for me". The latter was serious egg on
the face when our BOFH used to be a developer and turned over our first
AS/400 based accounting system to the masses.


Rob Berendt