RE: security jungle

["Fisher, Don" <DRF@xxxxxxxxxxxxxxxx>]

That command will work assuming a couple of things.  First, if PGMR already
has specific rights to an object, GRTOBJAUT will either bypass the object or
stop, but I'm not sure which.  For this reason, you need to specify *YES for
the "Replace authority" parameter.  The other assumption being implicitly
made is that you are not using adopted authority.  Even if PGMR is not
explicitly authorized to update a file, the program he/she is running will
still update the file if the program adopts the owner's authority and the
owner has authority to update the file.

Donald R. Fisher, III
Senior Programmer/Analyst
Heilig-Meyers Furniture Company
(804) 784-7500 ext. 2124
Don.Fisher@HeiligMeyers.com

> -----Original Message-----
> From: Mary Koetting [SMTP:Mary_Koetting@mail.mchcp.org]
> Sent: Friday, December 11, 1998 12:22 PM
> To:   'midrange'
> Subject:      security jungle
> 
> I would like to make sure that none of the programmers update pro
> duction libraries. We are all running under a group profile call PGMR with
> a
> no special authority.  
> Can I use GRTOBJAUT in the following manner to give them *read only
> rights?
> I don't want them to be able to update interactively or by executing a
> program.
> Thanks in advance and if anyone has a book/article that explains authority
> in simplistic terms I would greatly appreciate the reference. 
>  
>                        Grant Object Authority (GRTOBJAUT)
> 
>  
> 
>  Type choices, press Enter.
> 
>  
> 
>  Object . . . . . . . . . . . . . > *ALL          Name, generic*, *ALL
> 
>    Library  . . . . . . . . . . . >   MCPLIB      Name, *LIBL, *CURLIB,
> *ALL... 
>  Object type  . . . . . . . . . . > *ALL          *ALL, *ALRTBL,
> *BNDDIR...
> 
>  Users  . . . . . . . . . . . . . > PGMR          Name, *PUBLIC
> 
>                 + for more values
> 
>  Authority  . . . . . . . . . . . > *OBJOPR       *CHANGE, *ALL, *USE...
> 
>                 + for more values > *READ
> 
>  Authorization list . . . . . . .                 Name
> 
>  Reference object . . . . . . . .                 Name
> 
>    Library  . . . . . . . . . . .     *LIBL       Name, *LIBL, *CURLIB
> 
>  Reference object type  . . . . .   *OBJTYPE      *OBJTYPE, *ALRTBL,
> *BNDDIR... 
>  Replace authority  . . . . . . .   *NO           *NO, *YES
> 
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---