Re: QALWOBJRST

[Rob Berendt <robertowenberendt@xxxxxxxxx>]

What I find funny is that in the section:  "Controlling restoration of
security-sensitive objects"  It repeats this section to really drill it
into your head "Setting the QALWOBJRST system value to allow complete
recovery"
https://www.ibm.com/docs/en/i/7.5?topic=system-controlling-restoration-security-sensitive-objects

In the catastrophic failure checklist at
https://www.ibm.com/docs/en/i/7.5?topic=crpdfde-checklist-3-actions-load-source-disk-unit-failure
you will get to a step like this:
Task 5: Defining or changing the system at initial program load (IPL) - IBM
Documentation
<https://www.ibm.com/docs/en/i/7.5?topic=tros-task-5-defining-changing-system-initial-program-load-ipl>
https://www.ibm.com/docs/en/i/7.5?topic=tros-task-5-defining-changing-system-initial-program-load-ipl

Update the following system values.
Write down the existing values so you can update them after the recovery,
if necessary.
QALWOBJRST to *ALL
...

Summary:  Appease your auditors.  Bow to their wishes.  Just use one of
these IBM checklists, when the need arises, to justify changing it back
temporarily to complete your given task.  After all, how often do you
restore?  And, you just might stop a bad actor if you submit to their
wishes.
OTOH, you might want to check with your change management software how this
would play in Peoria.


On Tue, Mar 25, 2025 at 9:38 AM <smith5646midrange@xxxxxxxxx> wrote:

> The auditors at my client have told the admins that QALWOBJRST needs to be
> set to *ALWPTF because *ALL is a security risk.  Is *ALL really a security
> risk?
>
>
>
> My argument for *ALWPGMADP is that if someone restores a program that
> adopts
> authority and they do not have access to the owner profile, during the
> restore the OS changes the owner to QDFTOWNER (or something like that)
> which
> does not have any authority so who cares if it adopts its authority.
>
>
>
> The other options (*ALWSYSSTT, *ALWSETUID, *ALWSETGID, *ALWVLDERR) I don't
> really know what these are so I can't intelligently speak about them.
> Thus,
> I am turning to the knowledgeable people of this group.
>
>
>
> So, is there a good reason to not have *ALL?
>
>
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.