RE: hide payroll from the security officer -- MIDRANGE-L

How about creating a program (say to access command line) with owner
authority and then could George then change the owner of the object to the
group profile with *ALLOBJ and then run the program? 

Joe Giusto II
Patuxent Publishing Company
 <mailto:jgiusto@patuxent.com> mailto:JGiusto@patuxent.com
http://www.lifegoeson.com <http://lifegoeson.com> 


-----Original Message-----
From:   Greg Day [SMTP:gregday@starcity.com.au]
Sent:   Wednesday, June 23, 1999 3:43 AM
To:     MIDRANGE-L@midrange.com
Subject:        RE: hide payroll from the security officer

Bob,

In my example GEORGE does NOT have *ALLOBJ authority, but is grouped to a
profile (GRPSEC) that does have *ALLOBJ.  If he is explicitly EXCLUDED from
the PAYROLL library he cannot change the authority for that library. So he
cannot grant himself authority. He would have to sign-on as QSECOFR or
GRPSEC to grant himself authority, which of course, he can do. I would
Qaudit these two profiles.

I agree with all the philosophy on protecting who has *ALLOBJ etc.  I was
simply answering the original question.

Greg







Bob Crothers <bob@cstoneindy.com> on 22/06/99 20:54:07

Please respond to MIDRANGE-L@midrange.com

To:   "'MIDRANGE-L@midrange.com'" <MIDRANGE-L@midrange.com>
cc:    (bcc: Greg Day/SC/StarCity)
Subject:  RE: hide payroll from the security officer




Greg,

This will work up to a point.  However, since GEORGE has *ALLOBJ
authority, he can just remove the *EXCLUDE from his profile and then
he will be in.

Remember, *ALLOBJ is God.  If you have this, there is not much you can
NOT do.  It is more of a question of how much do you know how to do.

Bob

-----Original Message-----
From:     Greg Day [SMTP:gregday@starcity.com.au]
Sent:     Tuesday, June 22, 1999 1:32 AM
To:  MIDRANGE-L@midrange.com
Subject:  Re: hide payroll from the security officer

Alan,
Sorry this reply is so late. I've had a problem as a new user to the
list
getting my mails through.

You wrote:-

>I'd like to set up someone as a security officer, but exclcude them
from
>certain libraries.  What is the best way to go about doing this?

If you user profile has *ALLOBJ special authority then you cannot
restrict
access to libraries. Typically a *SECOFR user will have *ALLOBJ.

Here's what you can do:

1. Create a group profile (eg: GRPSEC) as a *SECOFR user class (with
*ALLOBJ authority etc)

2. Create a user profile (GEORGE) with say the *SYSOPR user class and
group
this profile to GRPSEC. parameter GRPPRF(GRPSEC).

3.  Grant private authority to the libraries for GEORGE to be
*EXCLUDE. You
can leave PUBLIC authority alone.

This will allow George to be a Security Officer with ALL the *SECOFR
special authorities, but will restrict his authority to the libraries
you
choose, even if PUBLIC authority is *USE *CHANGE or even *ALL.

This works because of the sequence that that the authority is checked.
 I
have an old redbook that lists the Authority search order:

USER PROFILE
1. Does user profile have *ALLOBJ special authority (In GEORGE's case
...NO)
2. Does user profile have explicit authority to the object (This is
where
we come in. GEORGE is EXCLUDED)
3. Does user profile appear on the authorization list of the object.

GROUP PROFILE
4. Does group profile have *ALLOBJ special authority.
5. Does group profile have explicit authority to the object.
6. Does group profile appear on the authorization list of the object.

PUBLIC
7. Use the object *PUBLIC authority unless *AUTL is indicated.
etc
etc

GEORGE is EXCLUDED from you sensitive libraries in step 2. Authority
checking then stops.

Hope this helps

Greg Day


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---






+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---