The Project | About Us | Contribute | Donations | License
HOME My courses Completed
◄ Previous
◄

Security and Permissions

Next ►
►

In this module, we will delve into the critical aspects of security and permissions in Control Language (CL). Understanding how to manage security and permissions is essential for maintaining the integrity and confidentiality of your system and data.

Key Concepts

  1. User Profiles: Define the identity of users and their access rights.
  2. Object Authority: Control access to objects such as files, programs, and libraries.
  3. Authorization Lists: Group objects and assign permissions collectively.
  4. Adopted Authority: Temporarily elevate permissions for specific tasks.
  5. Security Levels: System-wide settings that enforce security policies.

User Profiles

User profiles are the foundation of security in CL. They define who can access the system and what they can do.

Creating a User Profile

CRTUSRPRF USRPRF(USER1) PASSWORD('password') USRCLS(*USER) TEXT('Standard User Profile')
  • USRPRF: Specifies the user profile name.
  • PASSWORD: Sets the initial password.
  • USRCLS: Defines the user class (e.g., *USER, *SECADM).
  • TEXT: Provides a description of the user profile.

Modifying a User Profile

CHGUSRPRF USRPRF(USER1) STATUS(*DISABLED)
  • CHGUSRPRF: Command to change user profile attributes.
  • STATUS: Disables the user profile.

Object Authority

Object authority determines what actions a user can perform on an object.

Granting Object Authority

GRTOBJAUT OBJ('/path/to/object') OBJTYPE(*FILE) USER(USER1) AUT(*ALL)
  • GRTOBJAUT: Grants authority to an object.
  • OBJ: Specifies the object path.
  • OBJTYPE: Defines the type of object (e.g., *FILE, *PGM).
  • USER: Indicates the user receiving the authority.
  • AUT: Specifies the type of authority (e.g., *ALL, *USE, *CHANGE).

Revoking Object Authority

RVKOBJAUT OBJ('/path/to/object') OBJTYPE(*FILE) USER(USER1) AUT(*ALL)
  • RVKOBJAUT: Revokes authority from an object.

Authorization Lists

Authorization lists simplify the management of permissions by grouping objects.

Creating an Authorization List

CRTAUTL AUTL(AUTL1) TEXT('Authorization List for Project X')
  • CRTAUTL: Creates an authorization list.
  • AUTL: Specifies the authorization list name.
  • TEXT: Provides a description.

Adding Objects to an Authorization List

ADDAUTLE AUTL(AUTL1) OBJ('/path/to/object') OBJTYPE(*FILE)
  • ADDAUTLE: Adds an object to an authorization list.

Adopted Authority

Adopted authority allows a program to run with the authority of the program owner.

Creating a Program with Adopted Authority

CRTPGM PGM(MYLIB/MYPGM) USRPRF(*OWNER)
  • CRTPGM: Creates a program.
  • USRPRF: Specifies the user profile to adopt (*OWNER).

Security Levels

Security levels enforce system-wide security policies.

Setting the Security Level

CHGSYSVAL SYSVAL(QSECURITY) VALUE('40')
  • CHGSYSVAL: Changes a system value.
  • SYSVAL: Specifies the system value to change (QSECURITY).
  • VALUE: Sets the security level (e.g., 20, 30, 40, 50).

Practical Exercise

Exercise: Managing User Permissions

  1. Create a User Profile: Create a user profile named DEVUSER with a password devpass and user class *USER.
  2. Grant Object Authority: Grant DEVUSER *USE authority to a file /home/dev/file.txt.
  3. Create an Authorization List: Create an authorization list DEVLIST and add the file /home/dev/file.txt to it.
  4. Set Adopted Authority: Create a program MYLIB/DEVPGM that adopts the owner's authority.

Solution

-- Step 1: Create a User Profile
CRTUSRPRF USRPRF(DEVUSER) PASSWORD('devpass') USRCLS(*USER) TEXT('Developer User Profile')

-- Step 2: Grant Object Authority
GRTOBJAUT OBJ('/home/dev/file.txt') OBJTYPE(*FILE) USER(DEVUSER) AUT(*USE)

-- Step 3: Create an Authorization List
CRTAUTL AUTL(DEVLIST) TEXT('Developer Authorization List')
ADDAUTLE AUTL(DEVLIST) OBJ('/home/dev/file.txt') OBJTYPE(*FILE)

-- Step 4: Set Adopted Authority
CRTPGM PGM(MYLIB/DEVPGM) USRPRF(*OWNER)

Common Mistakes and Tips

  • Mistake: Forgetting to specify the correct object type when granting or revoking authority.
    • Tip: Always double-check the object type to ensure the command applies correctly.
  • Mistake: Not setting a strong password for user profiles.
    • Tip: Use complex passwords and enforce password policies to enhance security.

Conclusion

In this module, we covered the essential aspects of security and permissions in CL, including user profiles, object authority, authorization lists, adopted authority, and security levels. By mastering these concepts, you can effectively manage access and maintain the security of your system. In the next module, we will explore interfacing with other systems, which will build on the security foundations we've established here.

◄ Previous
◄
Next ►
►
The Project | About Us | Contribute | Donations | License
© Copyright 2024. All rights reserved