Re: Prevent a subsystem from starting

Thanks Chuck. I was not subscribed to MIDRANGE-L and was busy at the time
and could not repost.

I thought of all those things and I am also not sure "how else" a subsystem
may get started. I think saving a copy of the subsystem description and
deleting it might be my best bet. We have some software that, as part of
it's duties, may need to start it's subsystem to run some services -- but
in restricted state we do not want that subsystem popping up unexpectedly.
I can stop the software from starting it, but not the operator (unless I
delete the SBSD altogether).








On Thu, Jul 14, 2016 at 2:10 PM, CRPence <crpbottle@xxxxxxxxx> wrote:

On 14-Jul-2016 12:39 -0500, Stuart Rowe wrote:

On 14-Jul-2016 12:31 -0500, Stuart Rowe wrote:

I've been looking around for a while and can't figure out a
way to absolutely prevent a particular subsystem from starting.
Maybe it's not a common need. Anyone have any ideas?

[…] subsystem description that is user created.

Responding here, for lack of the discussion posted to midrange-l

Delete Subsystem Description (DLTSBSD) would be the most effective, and
quite nearly absolute; though additionally may be required, is to
revoke\grant authority to the user(s) that should not be allowed to request
Create Subsystem Description (CRTSBSD).

Resource authority to the *SBSD could prevent access by select user(s),
thus preventing Start Subsystem (STRSBS) by those users. However
controlling resource authority for an existing *SBSD may not be sufficient,
depending on the means utilized for effecting the start of the subsystem.

Of probable value would be Learning how the SBS is being started, and
then addressing that specific request\effect; e.g. issue the Remove
Autostart Job Entry (RMVAJE) plus adjust the authority of user(s) to the
associated subsystem of that AJE, and\or adjust authority for Add Autostart
Job Entry (ADDAJE) to prevent the user(s) from using that, to prevent
reintroduction of that as means to have started the subsystem.

The Command Analyzer Retrieve Exit Program with Exit Point Name
QIBM_QCA_RTV_COMMAND or Command Analyzer Change Exit Program with Exit
Point Name QIBM_QCA_CHG_COMMAND could probably also suffice, though I am
unsure if some start requests may occur without the use of the command;
e.g. probably the case, at least for the controlling subsystem? That could
enable restricting the command according to the invoker and the Subsystem
Description named on the SBSD() parameter, or perhaps with the Replace
Command Exit Program (QCARPLCM) API used as the exit program for
QIBM_QCA_CHG_COMMAND to effect invoking a custom STRSBS.

--
Regards, Chuck


--
This is the Rational Developer for IBM i / Websphere Development Studio
Client for System i & iSeries (WDSCI-L) mailing list
To post a message email: WDSCI-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/wdsci-l
or email: WDSCI-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/wdsci-l.