Re: STRSRVJOB and database journal entries

Edwin,

Just to clarify, 

> Considering that MARY is a programmer, MARY can probably
> do SBMJOB and
> specify USER(BOB)
> which could run a program that would make the same change
> and have the
> same result.  Journals show
> BOB made the change, but it was actually MARY.

Mary can only do the above if she has (at least) *USE authority to Bob's
profile.

This typically happens because Mary has *ALLOBJ, or Mary belongs to the
group that owns Bob's profile, or someone specifically gave Mary access
to Bob's profile.  But it is not natural.  The default on profile
creation is *PUBLIC = *EXCLUDE.

Another potential way to achieve the same end (but it only works at
QSECURITY level <40) is for Mary to submit a job using a job description
that has Bob's User name in the  "User" parameter.  in this case Mary
only needs *USE authority to the job description, and no authority to
BOB's user profile.

jte

--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl-Ua2wos9bJ7y1Z/[email protected]
www.powertech.com 
Celebrating our 10th Anniversary Year!
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of
> Edwin Davidson
> Sent: Thursday, June 29, 2006 12:47 PM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] STRSRVJOB and database journal
> entries
> 
> Considering that MARY is a programmer, MARY can probably
> do SBMJOB and
> specify USER(BOB)
> which could run a program that would make the same change
> and have the
> same result.  Journals show
> BOB made the change, but it was actually MARY.
> 
> I also agree that this isn't a "hole".
> 
> 
> 
> 
> http://www.primeinc.com
> **********************************************************
> ************
> This email and any files transmitted with it are
> confidential
> and intended solely for the use of the individual or
> entity to
> whom they are addressed.  If you have received this email
> in error please reply to the sender of the message.
> 
> The views expressed in this correspondence may not
> reflect the views of Prime, Inc.
> 
> This footnote also confirms that this email message has
> been scanned for the presence of computer viruses.
> **********************************************************
> ************
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
> (Security400) mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/security400.
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.