On 12-Jul-2017 11:20 -0600, Rob Berendt wrote:
[…]
- modify the security model to accept QRPLOBJ
[…]
- Rewrite the system that if the security model detects QRPLOBJ then
the called program, and the calling program, work out how to use the
new model […]
No need for a blind-acceptance of user_is_authorized whenever QRPLOBJ
is detected as the library name for the running program [if that is what
is alluded by "accept QRPLOBJ"]; yet, seems [to me] reasonable to just
_assume_ the user is [still] authorized.
Nor is there any need for a rewrite; the resolution is as simple as
inserting some code that precedes whatever is the existing authority
test, to redirect the authority-check against the "correct", the
original [name of the] program:
// Str: "New code:"
If pgm_libr='QRPLOBJ'; // this [running] pgm is in QRPLOBJ
// the following function may need to adopt aut to: QRPLOBJ *LIB
qualified_pgm=get_QRPLOBJ_text_qual_name(pgm_name:pgm_libr);
// procedure "get_QRPLOBJ_text_qual_name" can be implemented using
// the CL request Retrieve Object Description (RTVOBJD) or the
// Retrieve Object Description (QUSROBJD) API format OBJD0200;
// the program can adopt the necessary authority to access the
// QRPLOBJ library, for which public authority likely is *EXCLUDE
pgm_name=%subst(qualified_pgm:01:10);
pgm_libr=%subst(qualified_pgm:11:10);
end; // End: "New code:"
// "Existing code:"
Is_Authorized=Chk_Pgm_Aut(pgm_name:pgm_libr);
// per "New code:" action, the user's authority to the correct
// pgm will be tested here [by the chk_pgm_aut procedure] and
// the prior and following existing code continues unchanged …
The only potential issue, is if the authority to the newly recompiled
version of the program were changed, to be either less restrictive or
more restrictive than was in effect for the original invocation. As a
side effect of _only_ REPLACE(*YES) processing, however, the AUT() of
the new program would remain unchanged for that recompile alone.
Having a less restrictive authority seems innocuous enough, because
the implication is that the user is authorized to both the old and new
versions. Yet a more restrictive effect should be of little concern
too, IMO; although the program that is running was already accepted as a
valid/authorized usage, and that the identical program that will
continue to be called [or so we expect, given this situation was ever
even an issue, per the program PGM_A apparently not being re-resolved on
each new invocation] so arguably should remain "authorized", the
apparent intention is that the new program should no longer be
authorized to the user -- henceforth that would be dynamically decided
[vs a cached decision] and thus immediately enforced, despite the
non-dynamic nature of the invocation. Despite this being more
"complete", for actually performing the authority check, I expect in
most cases, the "blind acceptance" that the program running from a copy
in QRPLOBJ might just as well, _assume_ the user is [still] authorized.
midrange.com
