Re: Read-only SYSCATALOGS OK?

I tend to agree with Nathan here.

You need to find out why you want to omit them from syscatalogs. For
example, is it because I can query SYSCOLUMNS for all columns like '%SSN%'
and see if I can hack social security numbers? (I've used this as an
example on one system to push for better security and/or encryption. I
displayed the boss' SSN using an average user's id.)
If this is the case, you probably need better security on the end table
and it's columns.
Also, in this case, all the system catalogs do here is simplify doing a
DSPFFD of all the columns. It's just already preloaded.

Are you concerned about the view USER_INFO? It should only show the
average user their user id. To get a list of user profiles all the
average user has to do is DSPOBJD of all user type message queues. They
may not have access to the user profiles, but they will have access to the
message queues. Otherwise it makes it really tough to use SNDMSG to them.

Oh, so you use "limit capabilities" to block them from the command line?
Big flipping yawn.
I can just fire up "Run SQL Scripts" and use
CL: DSPOBJD OBJ(QUSRSYS/*ALL) OBJTYPE(*MSGQ) OUTPUT(*OUTFILE)
OUTFILE(MYLIB/MYFILE)
and then query that.

There's about a billion other hacks...

Again, why kill productivity just for a false sense of security?


Rob Berendt