Ed,

>From your "in most cases, not cause an existing job that is
running under that user profile to pick up the new group"
comment that STRDBG may just be one of the exceptions.
I say this because it appears as though debug with a
program specified, looks at the profile running the job and
not the current profile or group.

I am starting with a profile that has no group or supplemental
groups. I then set the effective group to the owner of the
program I am trying to debug and then run the STRDBG
command specifying the program name and it fails. If
I run STRDBG with no program, debug starts. I can then
add the program to debug with DSPMODSRC - F14 -
option 1.

In any case the authority check for a PGM and SRVPGM
are different on the STRDBG command. You can start
debug and specify a service program who's authority is
derived solely from an effective group swap. You cannot
run the debug command specifying a program who's
authority is derived from an effective group. With the
DSPMODSRC - F14 workaround I mentioned earlier it
is possible to debug a program based on authority
derived from an effective group.

I have not tried using STRSRVJOB.

Thanks,

David Morris

>>> edfishel@us.ibm.com 03/18/02 10:23AM >>>

David,

>Hopefully this doesn't confuse the issue more. I realize
>authority is checked at runtime, but I always thought it
>was derived when you sign on or swapped a profile. I
>am under this impression because changes to a profile
>are not retroactive to jobs that are signed on.

No we do not derive authority at sign-on or when the profile is
swapped. It
is derived at each point in time where it needs to be checked. Grant
and
revoke type changes will apply to all jobs that are currently active.

It is true that adding a group profile to user profile will, in most
cases,
not cause an existing job that is running under that user profile to
pick
up the new group. The only case were it would pick it up is if that
job
swapped user profiles to the changed user profile.

>I am changing the effective group to get more authority
>before running strdbg. I thought that I should get the same
>authority as I would get by changing the group profile
>and then signing on. That is not the case with debug.
>
>The strdbg command works OK if I change the profile
>to add the group profile in question and then signon. It
>does not work if I change the profile and then set the
>effective group for the job. Swaps do not work either,
>but my explanation of how I have tested that would
>probably add to the confusion.

Is the user profile a member of more than one group? Changing the
effective
group will replace only the first group profile and not any of the
Supplemental groups of the user profile while swap replaces
everything.

Are you using STRSRVJOB to debug this job or are you entering the
debug
commands from within the job that is being debugged?

Ed Fishel,
edfishel@US.IBM.COM



This thread ...


Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2020 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].