Re: Wayne Evans' LOGCMD

Ed Fishel wrote on 05/06/2008 09:30:11 AM:

> . . .                                    If the user of the
> program signs-off at the command line or their job is ended for any
reason
> then they will continue to have all auditing turned on.

Here is a version of the problem that reduces the risk of the job ending
before the auditing attributes of the user profile are restored. Now the
attributes are restored before the command line is displayed so there is no
danger of the user using the SIGNOFF command at that command line. I also
fixed a bug where the OBJAUD value for the user profile was not being
restored.

PGM
  DCL        VAR(&CURRENT) TYPE(*CHAR) LEN(12)
  DCL        VAR(&SAMEUSR) TYPE(*CHAR) LEN(12)
  DCL        VAR(&USER) TYPE(*CHAR) LEN(10)
  DCL        VAR(&OBJAUD) TYPE(*CHAR) LEN(10)
  DCL        VAR(&AUDLVL) TYPE(*CHAR) LEN(640)

  CALL       PGM(QSYS/QSYGETPH) PARM('*CURRENT' '*NOPWD' &CURRENT)
  QSYS/RTVUSRPRF  RTNUSRPRF(&USER) OBJAUD(&OBJAUD) AUDLVL(&AUDLVL)
  QSYS/CHGUSRAUD  USRPRF(&USER) OBJAUD(*ALL) AUDLVL(*AUTFAIL *CMD +
                    *CREATE *DELETE *JOBDTA *NETCMN *OBJMGT *OFCSRV +
                    *OPTICAL *PGMADP *PGMFAIL *PRTDTA *SAVRST +
                    *SECURITY *SERVICE *SPLFDTA *SYSMGT)
  CALL       PGM(QSYS/QSYGETPH) PARM(&USER      '*NOPWD' &SAMEUSR)
  QSYS/CHGUSRAUD  USRPRF(&USER) OBJAUD(&OBJAUD) AUDLVL(&AUDLVL)
  CALL       PGM(QSYS/QWTSETP)  PARM(&SAMEUSR)
  CALL       PGM(QSYS/QSYRLSPH) PARM(&SAMEUSR)

  CALL       PGM(QSYS/QUSCMDLN)

  CALL       PGM(QSYS/QWTSETP)  PARM(&CURRENT)
  CALL       PGM(QSYS/QSYRLSPH) PARM(&CURRENT)

ENDPGM

Ed Fishel,
edfishel-r/[email protected]

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.