Re: Permissions problem in PASE

Here's the solution to my problem.

Someone pointed out to me that the UNIX-style permissions that can be seen
within PASE are limited when compared to the IBM i view from DSPAUT (or
CHGAUT). We made certain the UNIX-style permissions in our new directory
exactly matched the old directly. Then we used WRKLNK option 9 (Work with
Authority) and saw that the profile which owns the directory had all data
authorities, but no object authorities. So we set object authorities on
the directory to *ALL for the profile which owns the directory.

We can now add and delete files in the directory without issue.

Michael Quigley
Computer Services
The Way International
www.TheWay.org

"MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx> wrote on 05/25/2016
02:45:14 PM:

----- Message from MichaelQuigley@xxxxxxxxxx on Wed, 25 May 2016 14:
33:54 -0400 -----

To:

midrange-l@xxxxxxxxxxxx

Subject:

Permissions problem in PASE

We recently changed banks. We've used SFTP to exchange information with
the bank. The SFTP part is working fine, but we're having problems where

in the job we call the QP2SHELL and the script generates a work file or
two. The same run of the script (by the same user in the same job)

cannot

remove the files before completing. The only difference is I set up a

new

folder for exchanging data with the new bank. The scripts used are the
same. We set up the authorities for the new directory using option 9 in
WRKLNK. The authorities looked the same there. However, going into PASE
(QP2TERM) and doing a ls -la showed the authorities were different.

Here's a session showing authorities and actions in the old directory
(only the actual directory name has been changed to protect the

innocent):

ls -ld Upload

drwxrws--- 2 prodowne 0 8192 May 25 11:27 Upload
/Prodlib/xxx_arp>$

cd Upload

/Prodlib/xxx_arp/Upload>$

touch testfile

/Prodlib/xxx_arp/Upload>$

ls -la

total 176
drwxrws--- 2 prodowne 0 8192 May 25 11:56 .
drwxrws--- 8 prodowne 0 53248 May 03 08:59 ..
-rw-rw-rw- 1 pgmmjq 0 0 May 25 11:56 testfile
/Prodlib/xxx_arp/Upload>$

rm testfile

/Prodlib/xxx_arp/Upload>$

===>

Everything works like I would expect. Now here's a session attempting to

do the same things in the new directory:

ls -ld Upload

drwxrws--- 2 prodowne 0 8192 May 24 19:53 Upload
/Prodlib/yyy>$

cd Upload

/Prodlib/yyy/Upload>$

touch testfile

/Prodlib/yyy/Upload>$

ls -la

total 40
drwxrws--- 2 prodowne 0 8192 May 24 19:53 .
drwxrws--- 7 prodowne 0 8192 May 23 14:29 ..
-rwsrwsrwt 1 pgmmjq pgmmr 0 May 25 12:00 testfile
/Prodlib/yyy/Upload>$

rm testfile

rm: 0653-609 Cannot remove testfile.
The file access permissions do not allow the specified action.
/Prodlib/yyy/Upload>$

rm testfile

rm: 0653-609 Cannot remove testfile.
The file access permissions do not allow the specified action.
/Prodlib/yyy/Upload>$


It's odd that the permissions where I can delete the file are -rw-rw-rw-

and rwsrwsrwt on the file I cannot delete.

I've opened a PMR with IBM, but I was surprised to learn that the PASE
commands are not "supported". They have been providing advice on things

to

try. I thought I would run it by here and see if anyone has any advice.

Michael Quigley
Computer Services
The Way International
www.TheWay.org