Re: Auditing adopt authority vs profile handles.

[Martin Rowe <martin@xxxxxxxxxx>]

On Thursday 29 April 2004 19:10, rob@xxxxxxxxx wrote:
> Well, the latest rage is to audit all programs that adopt authority. 
> Most of the security tool vendors have something to list out programs
> that run under a different user profile (USRPRF *OWNER).  Just got a
> guy here looking at profile handles.  How do you know what programs do
> that?  Or do they also need USRPRF *OWNER to do anything tricky?

I've a few routines that use profile handles which also adopt authority to 
perform the switch. Either you need the password of the profile you're 
adopting, or the profile running the switch needs *ALLOBJ (or full rights 
to the profile in question). Providing the password doesn't seem very 
secure (unless prompted for, maybe) so I assume you'd want 
usrprf(*owner).

Regards, Martin
-- 
martin@xxxxxxxxxx  AIM/Gaim: DBG400dotNet  http://www.dbg400.net   /"\
DBG/400 - AS/400 & iSeries Open Source/Free Software utilities     \ /
Debian GNU/Linux | ASCII Ribbon Campaign against HTML mail & news   X
                                                                   / \