Re: Authority on Java calls

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

I didn't find anything in my archives. But I've been thinking about the 
words I used.

Intensive probably implies a performance context. I don't think that's 
what I meant. I think I meant to say less impact - this was a discussion 
held at least a couple years ago now, and I never had opportunity to 
follow up, so memory furrows weren't plowed well.

I just looked up effective UID and GID - so this is a very simple-minded 
expression of what little I know right now.

This whole thing is a unix or posix idea, and the IFS is 
posix-compliant, IIRC. One source said that an effective uid or gid is 
about what a user can DO. The real usid is WHO the person is.

I think that impact is the better term - swapping a profile under which 
a job runs has to involve less change - hence impact - than changing one 
attribute under which the job runs.

I hope this helps a little - very little, probably. But it seems that 
swapping a profile can give a job more authority than you want, when all 
you want is authority to some files in the IFS.

Vern

On 10/8/2013 5:15 PM, Vernon Hamberg wrote:
> Hi Scott
>
> I'll have to dig back through some emails - will get back on this.
>
> Vern
>
> On 10/8/2013 4:50 PM, Scott Klement wrote:
> > I've heard Carol Woodbury recommend doing a setgid instead of swapping
> > profiles...  that way, if your job should crash or something before
> > swapping back, there's a much lower risk.  You're just running with a
> > different group id, that's all.
> >
> > I'm surprised when you say that changing the effective UID would be less
> > intensive vs. swapping profiles.  I would've thought these would do
> > exactly the same thing under the covers?   Changing group, yeah, I can
> > see that being less intensive, but...  changing uid?  Is that true?  Is
> > it really less resource intensive?
> >
> > On 10/8/2013 3:31 PM, Vernon Hamberg wrote:
> > > To the swapped-profile idea - I think it was an ISV support person at
> > > IBM who said to change the effective GID or UID of a job - this is just
> > > like swapping profiles, just less intensive. This is done with one or
> > > the other API, qsyseteuid or qsysetegid.
> > >
> > > HTH
> > > Vern