Re: Giving *SERVICE special authority to developers on production machine

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

Funny, I am just looking at this here - where we have only *USE 
authority to programs at production level on our development LPAR. 
Anything we create in our development libraries, no problem.

So I looked up *SERVICE special authority - it's not needed for 
STRSRVJOB that I can tell - the requirement there is that you have *USE 
to the user profile of the job user.

*SERVICE lets you use STRSST and do some traces. And it lets you debug 
programs without needing *CHANGE authority to the programs.

Taking access to STRSST away is not hard, and the InfoCenter article 
says that traces can be authorizes using function usage commands. You 
don't need *ALLOBJ, which was mentioned there.

So that's all I know right now - hope it makes sense.

Vern

On 9/25/2013 8:47 AM, rob@xxxxxxxxx wrote:
> I understand the general concept of not giving developers access to
> *SERVICE special authority on a production machine.  That is, they could
> use the graphical debugger (which uses STRSRVJOB under the covers) to
> debug a production program, change a running variable, and monkey around
> with data ( eval netpay=999999.99).  Knowing this, is there other reasons
> not to give them *SERVICE authority?  Like, "I read how to stop/start
> parity protection and wanted to try stopping it to see if it improved
> performance"?
>
> We already do not give them *ALLOBJ.  One, for security reasons.  Two,
> stops some of the "gee, it works for me".  The latter was serious egg on
> the face when our BOFH used to be a developer and turned over our first
> AS/400 based accounting system to the masses.
>
>
> Rob Berendt