RSTLIB -- Doesn't work

[Chipper]

Here's the basic gist:

1) My user profile has a user class of *PGMR and user group GRPTEST.

2) GRPTEST is a group for programmers (as well as "test" users for training purposes). It has *USE authority to production librs so programmers don't accidently do a clrpfm or something similar on a production libr.

3) The code below is a procedure to delete the test libr and restore it again from the most recent backup.

DLTLIB     TESTLIB
RSTLIB     SAVLIB(PRODLIB) DEV(TAP01) RSTLIB(TESTLIB)
GRTOBJAUT  OBJ(TESTLIB) OBJTYPE(*LIB) USER(GRPTEST) +
                          AUT(*ALL)
GRTOBJAUT  OBJ(TESTLIB/*ALL) OBJTYPE(*ALL) +
                          USER(GRPTEST) AUT(*ALL)

4) When I create the program that does the procedure (see #3), this is how it's done:

CRTBNDCL   MYLIBR/SETUPTEST  SRCFILE(MYLIBR/QSRC)
CHGPGM     MYLIBR/SETUPTEST  USRPRF(*OWNER)

This program is created with user profile QSECOFR.

5) When I try to run SETUPTEST with my user profile, it allows me to delete the libr but it blows up saying "not authorized do a RSTLIB." Doesn't CHGPGM mean the person is running the program "as if" they were QSECOFR?

6) My main goal is to be able to run the procedure with my user profile. I try to avoid signing on as QSECOFR whenever possible.

[tomholden]

Re: RSTLIB -- Doesn't work

Here's the basic gist:

1) My user profile has a user class of *PGMR and user group GRPTEST.

2) GRPTEST is a group for programmers (as well as "test" users for training purposes). It has *USE authority to production librs so programmers don't accidently do a clrpfm or something similar on a production libr.

3) The code below is a procedure to delete the test libr and restore it again from the most recent backup.

DLTLIB     TESTLIB
RSTLIB     SAVLIB(PRODLIB) DEV(TAP01) RSTLIB(TESTLIB)
GRTOBJAUT  OBJ(TESTLIB) OBJTYPE(*LIB) USER(GRPTEST) +
                          AUT(*ALL)
GRTOBJAUT  OBJ(TESTLIB/*ALL) OBJTYPE(*ALL) +
                          USER(GRPTEST) AUT(*ALL)

4) When I create the program that does the procedure (see #3), this is how it's done:

CRTBNDCL   MYLIBR/SETUPTEST  SRCFILE(MYLIBR/QSRC)
CHGPGM     MYLIBR/SETUPTEST  USRPRF(*OWNER)

This program is created with user profile QSECOFR.

5) When I try to run SETUPTEST with my user profile, it allows me to delete the libr but it blows up saying "not authorized do a RSTLIB." Doesn't CHGPGM mean the person is running the program "as if" they were QSECOFR?

6) My main goal is to be able to run the procedure with my user profile. I try to avoid signing on as QSECOFR whenever possible.

then don't sign on as QSECOFR just use SBMJOB CMD(CALL SETUPTEST) USER(QSECOFR)

[patrick]

Re: RSTLIB -- Doesn't work

Does your profile have any special authority ? to run RSTLIB you should atleast have *SECADM user class authority on lib should be atleast *change

[jmp]

Re: RSTLIB -- Doesn't work

5) When I try to run SETUPTEST with my user profile, it allows me to delete the libr but it blows up saying "not authorized do a RSTLIB."

What is the message id ?

Does QSECOFR have the *SAVSYS special authority ?

[egami]

Re: RSTLIB -- Doesn't work

Here's the basic gist:
Doesn't CHGPGM mean the person is running the program "as if" they were QSECOFR?

No. Doing a CHGPGM simply tells the OS which authority checking is used at run time for access to objects. If objects on your system are secured by authorization lists or user profiles then some programs will be compiled with adopted authority to allow a user to run a program that has access to something that the calling user profile does not have access to on their own.

It does not give you special authorities (SPCAUT on the CRTUSRPRF command) that are inherent to the owner of the object, however, and that is for good reason.

tomholden had the right answer. If you want to accomplish this probably the best way is to simply use the USER portion on the SBMJOB command that will act the way you were expecting it to work on the CHGPGM. Depending on your security the object may need some special attention to accomplish this task.

Personally, I don't recommend QSECOFR. In my world, QSECOFR is "holy" and only QSECOFR gets access to it. If I want regular users, power users or programmers to run something I have special profiles set up accordingly with various levels of access, but many shops are comfortable just using QSECOFR to accomplish those tasks.

[jmp]

Re: RSTLIB -- Doesn't work

USER(QSECOFR) isn't allowed in SBMJOB

[egami]

Re: RSTLIB -- Doesn't work

USER(QSECOFR) isn't allowed in SBMJOB

Good, it shouldn't be really. I wouldn't know first hand because it's a bad idea to begin with.

In my shops I always create internal user profiles with the appropriate authority.

[ABAdmin]

Re: RSTLIB -- Doesn't work

Hi there

maybe the user running the restore CLP is not added into the directory entries.

[DeadManWalks]

Re: RSTLIB -- Doesn't work

USER(QSECOFR) isn't allowed in SBMJOB

Actually it is.
We have a JobScdE that has to run under QSysOpr Due to the Group ID of the profile and the Group ID on the device we are connecting to.

But the only way to use QSecOfr is to be signed on as that profile.
This way prevents abuse of the profile.

[gcraill]

Re: RSTLIB -- Doesn't work

I don't have authority to see it, but if you go to iseries ops navigator as QSECOFR (or secadm?) there is an option under BRMS to allow access to restore commands based on user groups. You can then set a group up to have the RSTLIB access and control it from there. As I have no authority I can't get you screen shots - but I have seen it in ther past, also you can allow a user to check joblogs of other users without giving them *ALLOBJ authority from in there somewhere.