RE: Installing running applications as QSECOFR

["John Earl" <john.earl@xxxxxxxxxxxxx>]

> Queue John Earl :)
You just knew it was coming didn't you David :)

jte
--
 
John Earl, VP and Chief Technology Officer
PowerTech:   253-872-7788
Direct:          253-479-1408
Mobile:          206-669-3336
John.Earl@xxxxxxxxxxxxx
 

 
 
Email is an excellent way to communicate material that is not time
sensitive.  If your communication is of a more urgent nature, please
call. 
 
===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.
 

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx 
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of David Gibbs
> Sent: Tuesday, April 01, 2008 1:46 PM
> To: Midrange Systems Technical Discussion
> Subject: Re: Installing running applications as QSECOFR 
>
> Joe Pluta wrote:
> > I would argue that you don't need QSECOFR for most 
> operations.  If the 
> > product is required to adopt authority of profiles, it 
> would be just 
> > as easy to grant *USE authority to those profiles which it 
> needs to adopt.
> > There is rarely a need to have QSECOFR rights.
>
> In the case of SCM products, the authority REALLY is needed 
> ... because they have to be able to _manage_ the authorities 
> of the code they are moving around.  It's hard to manage the 
> (often vastly differing) authorities of other code unless you 
> have adequate authority.  In these cases, QSECOFR authority 
> is a necessity.
>
> In the case of MKS Implementer, we a very strong security 
> mechanism that protects any program that has to adopt higher 
> authority from misuse.
>
> Mind you, when Implementer is not actually moving code 
> around, it is still adopting authority ... but the profile is 
> a single 'product owner' 
> profile that has very limited capabilities (by default).
>
> > In those rare cases where it might be required, what I'd 
> like to see 
> > is something like su in Linux, where you would have to key in the 
> > QSECOFR profile to execute a particular function.
>
> Queue John Earl :)
>
> david
> (who works for MKS in addition to running these lists)
>
> --
> This is the Midrange Systems Technical Discussion 
> (MIDRANGE-L) mailing list To post a message email: 
> MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change 
> list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, 
> please take a moment to review the archives at 
> http://archive.midrange.com/midrange-l.