Re: chgc0100 exit point. was Default for command without default value?

["Steve Richter" <srichter@xxxxxxxxxxxxx>]

jte wrote:

>
>Not really.  It's possible that I may want to use an exit program that
>would adopt it's owner's authority, but not necessarily *ALLOBJ
>authority.  The restriction of requiring *ALLOBJ and *SECADM to
>register the exit program is sufficient, requiring the exit program to
>be owned by an *ALLOBJ profile would be onerous.
>


the chgc0100 exit pgm needs to adopt *allobj/*secadm rights?  If that is
needed, the exit pgm could call a pgm that adopts that authority.

Requiring the exit pgm to be owned by a fully privledged user ( is not
*FullPriv more descriptive than *allobj/*secadm ? ) prevents the replacement
of the registered exit pgm by a user with lesser authority.


>
>All of the above are just examples of how a person who has *ALLOBJ
>authority can compromise your system in an infinite number of ways.  A
>good approach is to make security work right up to the point that
>someone acquires *ALLOBJ authority.  At that point, it is impossible
>to secure anything from that person, so stop trying. The restriction
>on exit program registration is sufficient, more than that and you
>start to limit function without providing additional security.


disagree. the way it is now, if QPGMR owns the exit pgm, anyone in the Qpgmr
group can replace an exit pgm that was registered by an *allobj user. The
new pgm will be run by many different users on the system, some with *allobj
authority. Code in the new pgm could then check that the user is a known
*allobj/*secadm aut user and then do whatever it wants on the system.

Requiring the exit pgm be owned by an *a/*s user prevents this and does not
limit functionality.

Steve Richter



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---