It would seem so. It wouldn't be difficult. You can use DSPOBJD for all programs in a library to an outfile, then read the out file and use the Retrieve Program Information (QCLRPGMI) API format PGMI0100 to determine if adopted authority is being used.
Gary Monnier
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Wednesday, January 20, 2016 10:59 AM
To: midrange-l@xxxxxxxxxxxx
Subject: program authority audit.
Evaluating "program only access". This will allow only programs to modify data. The users may, or may not, continue to have "*USE" access to the data to facilitate queries.
In my understanding all this takes is some program near the top of the chain to have USRPRF(*OWNER) and for all other programs in the chain to have USEADPAUT(*YES).
For example, in an Infor shop you might have BPCSMENU owned by SSA and set to USRPRF(*OWNER). Infor does a fine job of using USEADPAUT(*YES) on all of their remaining programs.
So some user may have *USE to BPCSMENU. They could call that and then run Infor (providing their Infor security is set up right) to their hearts content. However, even if they did have have access to a command line, "Run SQL Scripts", etc they would not be able to use sql or anything to modify the data. If the data is *PUBLIC *EXCLUDE or some such thing.
I realize that this has no bearing on stream file data and that has to be handled with profile handles.
Now, I'd like to ensure that there are no programs that were modified to have USEADPAUT(*NO).
Doesn't seem to be a DSPPGM MYLIB/*ALL capability to an outfile.
There's no such SQL service, is there?
There's no IBM supplied security audit, is there?
Am I down to a list api, and a program API or two, to perform this audit?
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
midrange.com
