Feature Article

Library and Object Vulnerabilities When Using

Adoption of Authority and Swap User Profile APIs

By Dan Riehl - SecureMyi.com

Each job has an associated list of libraries called the job's library list or, as is often seen, *LIBL. When an object is requested during the job, the library list is searched, in order, to locate the object. There are several distinct portions of the library list: the System Portion, The Current Library, the Product Portion and the User Portion.

You can see the library list for your current job by using the command DSPLIBL (Display Library List), as shown here.

                       Display Library List                              
                                                       System:   SECUREMYI 
                                                                                
  Type options, press Enter.                                                     
   5=Display objects in library                                                 
                                                                                
  Opt       Library          Type    Text                                                
   _        ALTQSYS          SYS     Alternate QSYS library            
   _        QSYS             SYS     System Library                                      
   _        QSYS2            SYS     System Library for CPI's                            
   _        QHLPSYS          SYS                                                           
   _        QUSRSYS          SYS                                                           
   _        QPDA             PRD                                                           
   _        DRIEHL           CUR     Dan Riehl test library                              
   _        QGPL             USR     General Purpose Library                             
   _        QTEMP            USR                                      

The libraries in the System Portion (SYS) are controlled by the system administrator and are stored as the System Value QSYSLIBL. The Current Library (CUR) is specified in the User Profile of the user who started the job and can be changed dynamically by using the command CHGCURLIB (Change Current Library). The Product Portion (PRD) is dependent on applications that are currently running, and as such is dynamic within the job. The User Portion (USR) is controlled by the System Value QUSRLIBL but is often overridden by a Job Description or initial program that sets the User Portion as needed for the application.

Changing the Library List

There are many commands that are used to manipulate the library list. You can add and remove libraries by using CL commands such as EDTLIBL (Edit Library List), ADDLIBLE (Add Library List Entry) and RMVLIBLE (Remove Library List Entry).

Authority to Libraries on the Library List

When a job starts, the initial library list for the job is loaded, and the authority that the user has to each library in the list is retrieved and stored with the job's library list information. When a library is added to the list, its authority is also saved in the job's library list information.

The user's authority to the library, having already been resolved, remains consistent throughout the life of the job. This is true even if the user's authority to the library is changed or revoked during the job.

When an unqualified reference is made to an object, as in the Display File commands shown here:

DSPF FILE(MYFILE)     or     DSPF FILE(*LIBL/MYFILE)

the stored library list authority information is used. A new authority lookup is not performed when the library is already on the job's library list, which presents huge vulnerabilities in the case of adding a library to the list under adopted authority or while swapping to a more powerful User Profile.

Read More