RE: QALWOBJRST

We had a longtime system administrator who left ours at *ALL. My understanding is that he left it that way because you have to have additional authority to restore what is allowed with QALWOBJRST set to *ALL. That said in Carol Woodbury's book "IBM I Security ADMINISTRATION and COMPLIANCE", she recommends keeping it as secure as possible--using *NONE where appropriate or *ALWPTF.

When set to *NONE, loading PTFs can fail and hence the *ALWPTF setting.

If you have change management software which promotes programs with adopted authority, even the *ALWPTF setting can cause issues. Then she recommends using *ALWPGMADP. We use a lot of adopted authority to keep data secure. Which is another reason we went with *ALL. (Maybe *ALWPGMADP would have been a better choice.) I'm a Systems Analyst (not a Systems Administrator), but due to a lack of others with an understanding of IBM i, I've been given a lot of the SYSADMIN duties. Hence, I'm hesitant to make too many changes. I would probably defer to Rob. (I've included his message in the thread below, too.)

Whatever setting you use, you should have and document clear reasons for the setting. (As Rob suggests, setting it to your auditors recommendation can be a good, clear reason.)

Michael Quigley
Computer Services
The Way international
www.TheWay.org

-----Original Message-----

message: 2
date: Tue, 25 Mar 2025 09:38:15 -0400
from: smith5646midrange@xxxxxxxxx
subject: QALWOBJRST

The auditors at my client have told the admins that QALWOBJRST needs to be
set to *ALWPTF because *ALL is a security risk. Is *ALL really a security risk?



My argument for *ALWPGMADP is that if someone restores a program that
adopts authority and they do not have access to the owner profile, during
the restore the OS changes the owner to QDFTOWNER (or something like
that) which does not have any authority so who cares if it adopts its
authority.



The other options (*ALWSYSSTT, *ALWSETUID, *ALWSETGID, *ALWVLDERR)
I don't really know what these are so I can't intelligently speak about them.
Thus, I am turning to the knowledgeable people of this group.



So, is there a good reason to not have *ALL?

------------------------------

message: 5
date: Tue, 25 Mar 2025 10:49:59 -0400
from: Rob Berendt <robertowenberendt@xxxxxxxxx>
subject: Re: QALWOBJRST

What I find funny is that in the section: "Controlling restoration of security-
sensitive objects" It repeats this section to really drill it into your head
"Setting the QALWOBJRST system value to allow complete recovery"
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww
w.ibm.com%2Fdocs%2Fen%2Fi%2F7.5%3Ftopic%3Dsystem-controlling-
restoration-security-sensitive-
objects&data=05%7C02%7Cmichaelquigley%40theway.org%7Cb760234d97fb
433299f708dd6bb40f26%7Cdfc3789155b94fe0bc8b34a0f4b6650f%7C0%7C0%7
C638785143311788389%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiO
nRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyf
Q%3D%3D%7C0%7C%7C%7C&sdata=UQtdZPz0k2c9qjGS8%2BYXSBxlG%2Brd
bmcWviYC5f4Glf0%3D&reserved=0

In the catastrophic failure checklist at
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww
w.ibm.com%2Fdocs%2Fen%2Fi%2F7.5%3Ftopic%3Dcrpdfde-checklist-3-
actions-load-source-disk-unit-
failure&data=05%7C02%7Cmichaelquigley%40theway.org%7Cb760234d97fb4
33299f708dd6bb40f26%7Cdfc3789155b94fe0bc8b34a0f4b6650f%7C0%7C0%7
C638785143311817114%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiO
nRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyf
Q%3D%3D%7C0%7C%7C%7C&sdata=y7CHHzGwJMIrHyVu6ghvNR2n0PcyCpx
Bn7OCLfMcJL0%3D&reserved=0
you will get to a step like this:
Task 5: Defining or changing the system at initial program load (IPL) - IBM
Documentation
<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fw
ww.ibm.com%2Fdocs%2Fen%2Fi%2F7.5%3Ftopic%3Dtros-task-5-defining-
changing-system-initial-program-load-
ipl&data=05%7C02%7Cmichaelquigley%40theway.org%7Cb760234d97fb4332
99f708dd6bb40f26%7Cdfc3789155b94fe0bc8b34a0f4b6650f%7C0%7C0%7C63
8785143311842866%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRy
dWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%
3D%3D%7C0%7C%7C%7C&sdata=9r6%2B667jgYIuvSlRcnQh3IZEWW49c1fpiuzj
FDr8BAY%3D&reserved=0>
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww
w.ibm.com%2Fdocs%2Fen%2Fi%2F7.5%3Ftopic%3Dtros-task-5-defining-
changing-system-initial-program-load-
ipl&data=05%7C02%7Cmichaelquigley%40theway.org%7Cb760234d97fb4332
99f708dd6bb40f26%7Cdfc3789155b94fe0bc8b34a0f4b6650f%7C0%7C0%7C63
8785143311868096%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRy
dWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%
3D%3D%7C0%7C%7C%7C&sdata=qsN14Sfht4ksg8WXEJITBZ77%2BhbIt551Ll9x
YphiLFs%3D&reserved=0

Update the following system values.
Write down the existing values so you can update them after the recovery, if
necessary.
QALWOBJRST to *ALL
...

Summary: Appease your auditors. Bow to their wishes. Just use one of
these IBM checklists, when the need arises, to justify changing it back
temporarily to complete your given task. After all, how often do you
restore? And, you just might stop a bad actor if you submit to their wishes.
OTOH, you might want to check with your change management software
how this would play in Peoria.