Left to its own devices, your AS/400 may be giving users too much authority.
Whether you know it or not, you make use of the special value *LIBCRTAUT every time you create an object. *LIBCRTAUT is the default public authority assigned to an object at creation time. It is based on parameters specified when the library is created. As a result, you may be giving the public more authority to an object than you intend. The command prompter doesn't reveal *LIBCRTAUT for create commands under normal circumstances. But it's there if you press F10 and look at the AUT parameter.
Since the AUT parameter doesn't show up unless you press F10, you may have concluded that the *LIBCRTAUT value given as default is adequate in all cases. This may be true, but only if you understand precisely what you are giving away.
Library Security
In the early days of OS/400, you had to specify the public authority for an object at the time the object was created. For instance, when you compiled a program object, the AUT parameter of the CRTxxxPGM command would have a value such as *USE. This meant that the program being created had a public authority of *USE (all users would be allowed to run the program unless they were specifically excluded). For more information about public authority, see "Organizing Users with Group Profiles," MC, April 1993.
Recently, OS/400 added an attribute to the *LIB (library) object type, which specifies the default authority to give the public when an object is created in the library. This is the attribute which determines the authority given by *LIBCRTAUT. In turn, it is controlled by the CRTAUT (create authority) parameter of the Create Library (CRTLIB) or Change Library (CHGLIB) commands.
In other words, if you create or change library MYLIB and specify CRTAUT(*USE), all objects created from then on within MYLIB will have a default public authority of *USE, allowing users to read its files and run its programs and commands.
1 depicts the process of assigning public authority to a CL program at the moment of creation using the default. As you can see, special value *LIBCRTAUT is responsible for assigning *CHANGE authority to the public.
Figure 1 depicts the process of assigning public authority to a CL program at the moment of creation using the default. As you can see, special value *LIBCRTAUT is responsible for assigning *CHANGE authority to the public.
Overriding Library Security
A security scheme as simple as that would be too inflexible, however. Imagine if you were forced to give the same public authority to all objects in a library-it would create quite a nightmare. Therefore, each CRTxxx command contains an AUT (authority) parameter where you can specify the public authority for the object being created.
This parameter defaults to *LIBCRTAUT (wouldn't you know it), meaning that, unless you override it, the newly created object will have the public authority specified at the library level. You can, of course, override it with other values such as *ALL or *CHANGE-or even an authorization list name.
System Value QCRTAUT
It seems, therefore, that all depends on the value of the CRTAUT parameter during library creation or change. This parameter has a default value: *SYSVAL. When CRTAUT(*SYSVAL) is specified in the library, the value for the CRTAUT is obtained from system value QCRTAUT. As IBM ships AS/400s, QCRTAUT has a value of *CHANGE.
You can check the value of QCRTAUT with the Display System Value (DSPSYSVAL) command or by selecting option 5 from the panel presented by the Work with System Values (WRKSYSVAL) command. You can then change its value with the Change System Value (CHGSYSVAL) command or by selecting option 2 from WRKSYSVAL.
Implications
Let's pause for a minute to recap what you've learned. System value QCRTAUT has a value of *CHANGE (unless you've changed it). When you created library MYLIB, the CRTAUT parameter had a default value of *SYSVAL. This means that the objects you create in MYLIB will have a public authority of *CHANGE unless you specify otherwise.
You may have been creating hundreds of objects in your libraries, giving all users *CHANGE authority without knowing it. If you create a file, *CHANGE gives the public (any user) sufficient authority to add, change or delete records, read the file and open it with any program, Query program, or SQL. If you create a program, *CHANGE is enough to run the program. Ditto commands. Is this what you want?
Probably not. That's why it's so important to understand the meaning of *LIBCRTAUT-you may have created a security risk without knowing it.
Fixing the Mess-If You Have One
If you find that you have a problem on your hands, take heart. The remedy is pretty simple, although tedious. You have to use two commands. First, the Revoke Object Authority (RVKOBJAUT) command removes the current public authority from the objects. This gives *EXCLUDE authority to the public. Then, the Grant Object Authority (GRTOBJAUT) command gives the public the authority you want.
For example, if all files in library MYLIB have been created (through *LIBCRTAUT) with a public authority of *CHANGE and you want to change it to *USE, you would run the following commands:
RVKOBJAUT OBJ(MYLIB/*ALL) + OBJTYPE(*FILE) + USER(*PUBLIC) + AUT(*CHANGE) GRTOBJAUT OBJ(MYLIB/*ALL) + OBJTYPE(*FILE) + USER(*PUBLIC) + AUT(*USE)
Last But Not Least
You should also know that changing a library's CRTAUT attribute does not change the public authority of any of its existing objects. Once an object is created within the library, its public authority is fixed. If you later change the library's CRTAUT attribute, the change is effective only for objects you create afterwards.
Similarly, changing system value QCRTAUT doesn't change the public authority for any objects created in a library, even if the library has CRTAUT(*SYSVAL) specified. Again, the objects already have a public authority which won't automatically reflect changes made to QCRTAUT.
I hope I have succeeded in showing you the importance of *LIBCRT-AUT and why you should always mind it. Keeping a secure system is important, and OS/400 gives you the tools you need to do it. It's then up to you to use them correctly.
Ernie Malaga is a senior technical editor at Midrange Computing.
Watch Out for *LIBCRTAUT
Figure 1 How the System Uses *LIBCRTAUT
------------------------ ---------------- ||CRTCLPGM AUT(*LIBCRTAUT)|| --> ||Public Authori ------------------------ || || = *CHANGE || || ||-------------- || || || || || || V || || ---------------- || || New CL ||CRTAUT + *CHANGE||------------ || Program ||----------------|| || || || || || Library || -------------- || Definition ----------------
LATEST COMMENTS
MC Press Online