Re: IFS security problem

[Evan Harris <spanner@xxxxxxxxxx>]

Hi Syd and Ken

Stuff inline....


> > Here are the rules.....
> >
> > The new objects owner will always be the user that created the object.
> >
> > The new object's owner has the same object authority as the parent
> > directory's owner.
>
>The problem is that new object does NOT have the same authority as the parent
>directory. The object and directory owner is DNET. Only the data authority is
>inherited from the parent directory. The object authority is not!

How are you actually adding the file into the directory ? My experience has
been that in all cases the owner of the new object got the same authority
as the owner had to the directory, however, there is an inherit authority
flag (maybe *INDIR or something - I'm at home and relying on memory) which
has something to do with this. Perhaps one of the directories further up
the tree was created without this setting. Try creating a new tree and see
what behaviour you get; check the parameters as you create the directories.
WRKLNK might be handy here.

> > The new objects primary group has the same object authority as the parent
> > directory primary group
>
>Adding a primary group with sufficient authority, and ensuring DNET belongs to
>that group makes no difference. OS/400 checks the user authority - in this
>case
>DNET - finds object authority of *NONE and stops checking! DNET has no
>authority.
>
> >
> > The new object's public has the same object authority as the parent
> > directory's public.
> >
> > Authorization lists are inherited from the parent directory.

I have never been able to get this to work predictably. When using Network
neighborhood it seemd to work, but FTP (for instance) or CPYTOSTMF produced
a whole different set of behaviours. Under what circumstance does the
authorisation list get added to the new object ?

>The use of an authorisation list also makes no difference to the problem. If
>DNET is included in the authorisation list with authority *ALL, DNET still has
>no object authority. If one manually removes DNET from the list of authorised
>users, whilst still retaining the authorisation list, then DNET now has object
>authority.
>
> > A user requires Unix " W " authority to a directory + OS/400 *OBJEXIST
> > authority to the directory in order to add or remove objects from a
> > directory, regardless of authority to the object.
> >
>
>Yes - but how do we get this to happen automatically?

Yeah how do we :)

Regards
Evan Harris