Re: LODRUN

[rob@xxxxxxxxx]

Simple.  Don't own the objects by QSECOFR.  Have the stuff that needs that 
ran by a trusted individual that has that authority.  If a particular 
utility is used in a lot of tasks normally performed by nontrusted 
individuals you better be prepared to document the snot out of why they 
need to adopt authority.

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 





Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
05/22/2003 02:39 PM
Please respond to Midrange Systems Technical Discussion
 
        To:     Midrange Systems Technical Discussion 
<midrange-l@xxxxxxxxxxxx>
        cc: 
        Fax to: 
        Subject:        Re: LODRUN


Rob

There are things in many products, including some of ours, that require 
full access to a system. Various system utilities fall into this area. The 

API used by our CD-ROM product got more restrictive in V5R1, e.g. Install 
programs may need *IOCONFIG, etc. Now most of our stuff IS owned by 
QSECOFR 
but does NOT adopt that authority, unless it's needed.

And there is always the ability to swap profiles, of course.

What would you need from a vendor in this situation? Is a section in the 
documentation sufficient? We certainly don't have anything to hide and do 
not want to cause any concerns to anyone. What helps a trustful (made up 
word) relationship with a vendor?

Anyone can reply to this - I'm interested in various points of view.

Regards

Vern

At 10:38 AM 5/21/2003 -0500, you wrote:
>We purchased a package in which numerous objects were owned by QSECOFR.
>One of the programs did only a CALL QCMD.  Seems that the vendor support
>people liked to talk the accounting people through stuff and didn't want
>to deal with those pesky security people.  Thus, I am leery as he!! about
>anything owned by QSECOFR.
>
>Rob Berendt


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.