Re: [Security400] DSPJOBLOG needs *JOBCTL authority?

[thomas@xxxxxxxxxxx]

Dan:

On Wed, 26 September 2001, "Bale, Dan" wrote:

>   Since the CPP
> for DSPJOBLOG is QMHDSPJL, could I just change the program to adopt
> authority?  Just now looking that program up, it is owned by QSYS and
> already runs under the *OWNER user profile; it is also set to use
> adopted authority.  Since QSYS already has *JOBCTL authority, why is a
> profile without this specific authority denied access to the command?

While QMHDSPJL may have the authority already, it also the authority to test 
whether the user has the authority and it has instructions to reject the 
request if user authority is insufficient. Pretty basic, eh?

Since you can't give *JOBCTL, those users will have to expect that whatever 
tool you give will not work in common situations such as WRKACTJOB (or WRKSBS 
or WRKSBSJOB, both of which I prefer to WRKACTJOB for most uses anyway). You 
might want to create it with a basic front end that gives a subfile list of 
active jobs if requested and allows selection for DSPJOBLOG. Beyond that, I'd 
ignore requests such as "But why don't it work through WRKACTJOB option 10?" -- 
though I might respond by revoking authority to WRKACTJOB and asking "Why were 
you running that command?".

No need to "fundle" with QSYSLIBL, no need to replace or modify DSPJOBLOG. Just 
give a tool that does what's needed. Anyone needing more should be required to 
create some kind of justification documentation and get it approved.

Tom Liotta

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788
Fax  253-872-7904
http://www.400Security.com


___________________________________________________
The ALL NEW CS2000 from CompuServe
 Better!  Faster! More Powerful!
 250 FREE hours! Sign-on Now!
 http://www.compuserve.com/trycsrv/cs2000/webmail/