Re: Installing running applications as QSECOFR

[David Gibbs <david@xxxxxxxxxxxx>]

Joe Pluta wrote:
> I would argue that you don't need QSECOFR for most operations.  If the 
> product is required to adopt authority of profiles, it would be just as 
> easy to grant *USE authority to those profiles which it needs to adopt.  
> There is rarely a need to have QSECOFR rights.

In the case of SCM products, the authority REALLY is needed ... because 
they have to be able to _manage_ the authorities of the code they are 
moving around.  It's hard to manage the (often vastly differing) 
authorities of other code unless you have adequate authority.  In these 
cases, QSECOFR authority is a necessity.

In the case of MKS Implementer, we a very strong security mechanism that 
protects any program that has to adopt higher authority from misuse.

Mind you, when Implementer is not actually moving code around, it is 
still adopting authority ... but the profile is a single 'product owner' 
profile that has very limited capabilities (by default).

> In those rare cases where it might be required, what I'd like to see is 
> something like su in Linux, where you would have to key in the QSECOFR 
> profile to execute a particular function.

Queue John Earl :)

david
(who works for MKS in addition to running these lists)