Re: IFS security problem

[Syd Nicholson <sydnic@xxxxxxxxxx>]

*This message was transferred with a trial version of CommuniGate(tm) Pro*
>

Thanks Ken,

> Here are the rules.....
>
> The new objects owner will always be the user that created the object.
>
> The new object's owner has the same object authority as the parent
> directory's owner.

The problem is that new object does NOT have the same authority as the parent
directory. The object and directory owner is DNET. Only the data authority is
inherited from the parent directory. The object authority is not!

> The new objects primary group has the same object authority as the parent
> directory primary group

Adding a primary group with sufficient authority, and ensuring DNET belongs to
that group makes no difference. OS/400 checks the user authority - in this case
DNET - finds object authority of *NONE and stops checking! DNET has no
authority.

>
> The new object's public has the same object authority as the parent
> directory's public.
>
> Authorization lists are inherited from the parent directory.
>

The use of an authorisation list also makes no difference to the problem. If
DNET is included in the authorisation list with authority *ALL, DNET still has
no object authority. If one manually removes DNET from the list of authorised
users, whilst still retaining the authorisation list, then DNET now has object
authority.

> A user requires Unix " W " authority to a directory + OS/400 *OBJEXIST
> authority to the directory in order to add or remove objects from a
> directory, regardless of authority to the object.
>

Yes - but how do we get this to happen automatically?

>
> Kenneth

Syd