IBM / portlibfori

A set of APIs to enable applications to be more easily ported to PASE on IBM i
Other
8 stars 7 forks source link

Add API(s) for getting user's special authorities #11

Open kadler opened 4 years ago

kadler commented 4 years ago

I think it should work something like this:

// sort of modeled after getpwnam/getpwuid
int get_special_authorities_uid(uid_t uid);
int get_special_authorities_nam(const char* name);

int auth = get_special_authorities_uid(0); // QSECOFR
assert(auth & AUTH_ALLOBJ);

int auth = get_special_authorities("*CURRENT");
if (auth & AUTH_JOBCTL) printf("Current user has *JOBCTL\n");

The API would be based on QSYUSRI.

@ThePrez had a previous attempt when it was on BitBucket: https://bitbucket.org/litmis/portlibfori/pull-requests/1/checkspcaut/diff That went a different way, using QSYCUSRS instead. The semantics are slightly different between these two approaches.

QSYUSRI tells which authorities are given to a user profile object outright, but an MI program can adopt or drop authorites so the authorities checked by QSYCUSRS could be different for the same user when called by different programs. PASE does not support adopted authority, though, so it's largely irrelevant unless you're calling in to PASE from ILE, which isn't very common. For any program started from PASE, it will only have the authorities specified by the user profile that it was started under.

NattyNarwhal commented 3 years ago

You could do both and treat it like how POSIX has an effective-ID API equivalent.