Re: Adopted Authority and *IOSYSCFG - is this a bug ?

[David Gibbs <david@xxxxxxxxxxxx>]

You could try user profile handle switching to a profile that has the
*iosyscfg authority.

https://www.mysamplecode.com/2012/06/as400-switch-user-profile.html

David

On Sat, Nov 6, 2021 at 5:22 PM Evan Harris <auctionitis@xxxxxxxxx> wrote:

> Hi All
>
> I've been working on some small programs that make changes requiring
> *IOSYSCFG which are to be run at startup. All the programs work as expected
> except for one thing: adopted authority does not provide *IOSYSCFG to the
> user that calls the program.
>
> What I found when I added a call to my program into the program specified
> in QSTRUPPGM was that job QSTRUPJD would fail even though the program
> making the changes was using adopted authority.
>
> Looking in the Security Reference I can't see anything specific about
> *IOSYSCFG not being allowed for adopted authority, but I note that most of
> the examples relate to object security.
>
> To test I wrote a small program that adds a host table entry:
>
> PGM
> ADDTCPHTE  INTNETADR('192.168.9.99') HOSTNAME((DELETE.ME))
> ENDPGM
>
> I then compiled the program with USRPRF(*OWNER) and made sure the owner had
> *IOSYSCFG special authority. When I run the program using a profile without
> *IOSYSCFG I get:
> TCP8050: *IOSYSCFG authority required to use ADDTCPHTE.
>
> What is even stranger to me is that if I change the program specified in
> QSTRUPPGM to USRPRF(*OWNER) and change the owner of that program to a
> profile with *IOSYSCFG special authority, the call to the program requiring
> *IOSYSCFG runs as expected and QSTRUPJD completes normally.
>
> This seems like a bug, but it would not surprise me if there is a security
> exception somewhere that I just haven't found.
>
> Any other theories or suggestions ?
>
> --
>
> Regards
> Evan Harris
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com