RE: [Security400] Debug anomaly

["Ed Fishel" <edfishel@xxxxxxxxxx>]

David,

>Hopefully this doesn't confuse the issue more. I realize
>authority is checked at runtime, but I always thought it
>was derived when you sign on or swapped a profile. I
>am under this impression because changes to a profile
>are not retroactive to jobs that are signed on.

No we do not derive authority at sign-on or when the profile is swapped. It
is derived at each point in time where it needs to be checked. Grant and
revoke type changes will apply to all jobs that are currently active.

It is true that adding a group profile to user profile will, in most cases,
not cause an existing job that is running under that user profile to pick
up the new group. The only case were it would pick it up is if that job
swapped user profiles to the changed user profile.

>I am changing the effective group to get more authority
>before running strdbg. I thought that I should get the same
>authority as I would get by changing the group profile
>and then signing on. That is not the case with debug.
>
>The strdbg command works OK if I change the profile
>to add the group profile in question and then signon. It
>does not work if I change the profile and then set the
>effective group for the job. Swaps do not work either,
>but my explanation of how I have tested that would
>probably add to the confusion.

Is the user profile a member of more than one group? Changing the effective
group will replace only the first group profile and not any of the
Supplemental groups of the user profile while swap replaces everything.

Are you using STRSRVJOB to debug this job or are you entering the debug
commands from within the job that is being debugged?

Ed Fishel,
edfishel@US.IBM.COM