Common commands for most objects

This table lists commands that can work on most objects in alphabetical order.

Commands identified by (Q) are shipped with public authority *EXCLUDE. Commands shipped with public authority *EXCLUDE shows which IBM-supplied user profiles are authorized to the command. The security officer can grant *USE authority to others.

Table 1. Common commands for most objects
Command	Referenced object	Authority needed
Command	Referenced object	For object	For library
ALCOBJ ^1,2,11	Object	*OBJOPR	*EXECUTE
ANZOBJCVN (Q) ²⁰
ANZUSROBJ ²⁰
CHGOBJAUD ¹⁸	ASP Device (if specified)	*USE
CHGOBJD ³	Object, if it is a file	OBJOPR, OBJMGT	*EXECUTE
CHGOBJD ³	Object, if it is not a file	*OBJMGT	*EXECUTE
CHGOBJOWN ^3,4,36	Object	*OBJEXIST	*EXECUTE
	Object (if file, library, subsystem description)	OBJOPR, OBJEXIST	*EXECUTE
	Object (if *AUTL )	Ownership or *ALLOBJ	*EXECUTE
	Old user profile	*DLT	*EXECUTE
	New user profile	*ADD	*EXECUTE
	ASP Device (if specified)	*USE
CHGOBJPGP ^3,36	Object	*OBJEXIST	*EXECUTE
	Object (if file, library, subsystem description)	OBJOPR, OBJEXIST	*EXECUTE
	Object (if *AUTL )	Ownership and OBJEXIST, or ALLOBJ	*EXECUTE
	Old user profile	*DLT
	New user profile	*ADD
	ASP Device (if specified)	*USE
CHKOBJ ³	Object	Authority specified by AUT parameter ¹⁴	*EXECUTE
CPROBJ	Object	*OBJMGT	*EXECUTE
CHKOBJITG ¹¹(Q)
CRTDUPOBJ ^3,9,11,21	New object		USE, ADD
	Object being copied, if it is an *AUTL	*AUTLMGT	USE, ADD
	Object being copied, all other types	OBJMGT, USE	*USE
	CRTSAVF command (if the object is a save file)	*OBJOPR
	ASP Device (if specified)	*USE
DCPOBJ	Object	*USE	*EXECUTE
DLCOBJ ^1,11	Object	*OBJOPR	*EXECUTE
DLTOBJ ³⁵	Object	*OBJEXIST	*EXECUTE
DLTOBJ ³⁵	ASP Device (if specified)	*USE
DMPOBJ (Q) ³	Object	OBJOPR, READ	*EXECUTE
DMPSYSOBJ (Q)	Object	OBJOPR, READ	*EXECUTE
DSPOBJAUT ³	Object (to see all authority information) ³⁶	OBJMGT or ALLOBJ special authority or ownership	*EXECUTE
	Output file	Refer to the general rules.	Refer to the general rules.
	ASP Device (if specified) ³⁶	*USE
DSPOBJD ^2, 28	Output file	Refer to the general rules.	Refer to the general rules.
	Object	Some authority other than *EXCLUDE	*EXECUTE
	ASP Device (if specified)	*EXECUTE
EDTOBJAUT ^3,5,6,15,36	Object	*OBJMGT	*EXECUTE
	Object (if file)	OBJOPR, OBJMGT	*EXECUTE
	*AUTL, if used to secure object	Not *EXCLUDE
	ASP Device (if specified)	*USE
GRTOBJAUT ^3,5,6,15,36	Object	*OBJMGT	*EXECUTE
	Object (if file)	OBJOPR, OBJMGT	*EXECUTE
	*AUTL, if used to secure object	Not *EXCLUDE
	ASP Device (if specified)	*USE
	Reference ASP Device (if specified)	*EXECUTE
	Reference object	*OBJMGT or Ownership	*EXECUTE
MOVOBJ ^3,7,12	Object	*OBJMGT
	Object (if *FILE)	ADD, DLT, *EXECUTE
	Object (not *FILE),	DLT, EXECUTE
	From-library		*CHANGE
	To-library		READ, ADD
	ASP Device (if specified)	*USE
PRTADPOBJ ²⁶(Q)
PRTPUBAUT ²⁶
PRTUSROBJ ²⁶
PRTPVTAUT ²⁶
RCLDBXREF
RCLOBJOWN (Q)
RCLSTG (Q)
RCLTMPSTG (Q)	Object	*OBJMGT	*EXECUTE
RMVDFRID (Q) ¹⁰
RNMOBJ ^3,11	Object	*OBJMGT	UPD, EXECUTE
	Object, if *AUTL	*AUTLMGT	*EXECUTE
	Object (if *FILE)	OBJOPR, OBJMGT	UPD, EXECUTE
	ASP Device (if specified)	*USE
RSTDFROBJ (Q) ¹⁰	QSYS/QPSRLDSP printer output, if OUTPUT(*PRINT) specified	*USE	*EXECUTE
	Output file, if specified	Refer to the general rules	Refer to the general rules
	QSYS/QASRRSTO field reference file for output file, if an output file is specified and does not exist	*USE	*EXECUTE
RSTOBJ (Q)^{3,13, 31, 33}	Object, if it already exists in the library	*OBJEXIST ⁸	EXECUTE, ADD
	Object, if it is CFGL, CNNL, CTLD, DEVD, LIND, or NWID	CHANGE and OBJMGT	*EXECUTE
	Media definition	*USE	*EXECUTE
	Message queues being restored to library where they already exist	OBJOPR, OBJEXIST ⁸	EXECUTE, ADD
	User profile owning objects being created	*ADD ⁸
	Program that adopts authority	Owner or SECADM and ALLOBJ special authority	*EXECUTE
	To-library	EXECUTE, ADD ⁸
	Library for saved object if VOL(*SAVVOL) is specified	*USE ⁸
	Save file	*USE	*EXECUTE
RSTOBJ (Q)	Tape unit or optical unit	*USE	*EXECUTE
	Tape (QSYSTAP) file or diskette (QSYSDKT) file	*USE ⁸	*EXECUTE
	Optical File (OPTFILE)²²	*R	Not applicable
	Parent Directory of optical file (OPTFILE)²²	*X	Not applicable
	Path prefix of OPTFILE²²	*X	Not applicable
	Optical volume²⁴	*USE	Not applicable
	QSYS/QPSRLDSP printer output, if OUTPUT(*PRINT) specified	*USE	*EXECUTE
	Output file, if specified	Refer to the general rules.	Refer to the general rules.
	QSYS/QASRRSTO field reference file for output file, if an output file is specified and does not exist	*USE	*EXECUTE
	ASP device description²⁵	*USE
RSTSYSINF	Save file	*USE	*EXECUTE
	Tape unit or optical unit	*USE	*EXECUTE
	Optical File (OPTFILE)²²	*R	Not applicable
	Parent Directory of optical file (OPTFILE)²²	*X	Not applicable
	Path prefix of OPTFILE²²	*X	Not applicable
	Optical volume²⁴	*USE	Not applicable
RVKPUBAUT ²⁰
RTVOBJD ^2, 29	Object	Some authority other than *EXCLUDE	*EXECUTE
RVKOBJAUT ^{3,5,15, 27,36}	ASP Device (if specified)	*USE
SAVCHGOBJ ^{3, 32}	Object (8)	*OBJEXIST	*EXECUTE
	Tape unit or optical unit	*USE	*EXECUTE
	Save file, if empty	USE, ADD	*EXECUTE
	Save file, if records exist in it	OBJMGT, USE, *ADD	*EXECUTE
	Save active message queue	OBJOPR, ADD	*EXECUTE
	Command user space, if specified	*USE	*EXECUTE
SAVCHGOBJ	Optical File (OPTFILE)²²	*RW	Not applicable
	Parent Directory of optical file (OPTFILE)²²	*WX	Not applicable
	Path prefix of optical file (OPTFILE)²²	*X	Not applicable
	Root Directory (/) of optical volume^22, 23	*RWX	Not applicable
	Optical volume²⁴	*CHANGE
	Output file, if specified	Refer to the general rules.	Refer to the general rules.
	QSYS/QASAVOBJ field reference file for output file, if an output file is specified and does not exist	*USE ⁸	*EXECUTE
	QSYS/QPSAVOBJ printer output	*USE ⁸	*EXECUTE
	ASP device description²⁵	*USE
SAVOBJ ^{3, 32}	Object	*OBJEXIST ⁸	*EXECUTE
	Media definition	*USE	*EXECUTE
	Tape unit or optical unit	*USE	*EXECUTE
	Save file, if empty	USE, ADD	*EXECUTE
	Save file, if records exist in it	OBJMGT, USE, *ADD	*EXECUTE
	Save active message queue	OBJOPR, ADD	*EXECUTE
	Command user space, if specified	*USE	*EXECUTE
SAVOBJ	Optical File (OPTFILE) ²²	*RW	Not applicable
	Parent Directory of optical file (OPTFILE)²²	*WX	Not applicable
	Path prefix of OPTFILE²²	*X	Not applicable
	Root directory (/) of optical volume ^22, 23	*RWX	Not applicable
	Optical volume²⁴	*CHANGE
	Output file, if specified	Refer to the general rules.	Refer to the general rules.
	QSYS/QASAVOBJ field reference file for output file, if an output file is specified and does not exist	*USE ⁸	*EXECUTE
	QSYS/QPSAVOBJ printer output	*USE ⁸	*EXECUTE
	ASP device description²⁵	*USE
SAVSTG ¹⁰
SAVSYS ¹⁰	Tape unit, optical unit	*USE	*EXECUTE
	Root directory (/) of optical volume²²	*RWX	Not applicable
	Optical volume²⁴	*CHANGE	Not applicable
SAVSYSINF	Media definition	*USE	*EXECUTE
	Tape unit or optical unit	*USE	*EXECUTE
	Save file, if empty	USE, ADD	*EXECUTE
	Save file, if records exist in it	OBJMGT, USE, *ADD	*EXECUTE
	Optical File (OPTFILE) ²²	*RW	Not applicable
	Parent Directory of optical file (OPTFILE)²²	*WX	Not applicable
	Path prefix of OPTFILE²²	*X	Not applicable
	Root directory (/) of optical volume ^22, 23	*RWX	Not applicable
	Optical volume²⁴	*CHANGE
SAVRSTCHG	On the source system, same authority as required by SAVCHGOBJ command.
	On the target system, same authority as required by RSTOBJ command.
	ASP device description²⁵	*USE
SAVRSTOBJ	On the source system, same authority as required by SAVOBJ command.
	On the target system, same authority as required by RSTOBJ command.
	ASP device description²⁵	*USE
SETOBJACC	Object	*OBJOPR	*EXECUTE
STROBJCVN (Q)²⁰
STRSAVSYNC³⁴
WRKOBJ ^19,36	Object	Any authority	*USE
WRKOBJLCK	Object		*EXECUTE
WRKOBJLCK	ASP Device	*EXECUTE
WRKOBJOWN ¹⁷	User profile	*READ	*EXECUTE
WRKOBJPGP ¹⁷	User profile	*READ	*EXECUTE
WRKOBJPVT¹⁷	User profile	*READ	*EXECUTE
¹ See the OBJTYPE keyword of the ALCOBJ command for the list of object types that can be allocated and deallocated. ² Some authority to the object (other than EXCLUDE) is required. ³ This command cannot be used for documents or folders. Use the equivalent Document Library Object (DLO) command. ⁴ You must have ALLOBJ and SECADM special authority to change the object owner of a program, service program, or SQL package that adopts authority. ⁵ You must be the owner or have OBJMGT authority and the authorities being granted or revoked.
⁶ You must be the owner or have ALLOBJ special authority to grant OBJMGT or AUTLMGT authority. ⁷ This command cannot be used for user profiles, controller descriptions, device descriptions, line descriptions, documents, document libraries, and folders. ⁸ If you have SAVSYS special authority, you do not need the authority specified. ⁹ If the user running the CRTDUPOBJ command has OWNER(GRPPRF) in his user profile, the owner of the new object is the group profile. To successfully copy authorities to a new object owned by the group profile, the following applies: The user running the command must have authority to the from-object. Authorities can be obtained from adopted authority or through the group profile. If an error occurs while copying authorities to the new object, the newly created object is deleted. ¹⁰ You must have SAVSYS special authority.
¹¹ This command cannot be used for journals and journal receivers. ¹² This command cannot be used for journals and journal receivers, unless the from-library is QRCL and the to-library is the original library for the journal or journal receiver. ¹³ You must have ALLOBJ special authority to specify a value other than NONE for the Allow object differences (ALWOBJDIF) parameter. ¹⁴ To check a user's authority to an object, you must have the authority you are checking. For example, to check whether a user has OBJEXIST authority for FILEB, you must have OBJEXIST authority to FILEB. ¹⁵ To secure an object with an authorization list or remove the authorization list from the object, you must do one of the following actions: Own the object. Have ALL authority to the object. Have ALLOBJ special authority.
¹⁶ If either the original file or the renamed file has an associated authority holder, ALL authority to the authority holder is required. ¹⁷ This command does not support the QOPT file system. ¹⁸ You must have AUDIT special authority. ¹⁹ To use an individual operation, you must have the authority required by the individual operation. ²⁰ You must have *ALLOBJ special authority.
²¹ All authorities on the from-object are duplicated to the new object. The primary group of the new object is determined by the group authority type (GRPAUTTYP) field in the user profile that is running the command. If the from-object has a primary group, the new object might not have the same primary group, but the authority that the primary group has on the from-object will be duplicated to the new object. ²² This authority check is only made when the Optical media format is Universal Disk Format. ²³ This authority check is only made if you are clearing the optical volume. ²⁴ Optical volumes are not actual system objects. The link between the optical volume and the authorization list used to secure the volume is maintained by the optical support function. ²⁵ Authority required only if save or restore operation requires a library namespace switch.
²⁶ You must have ALLOBJ or AUDIT special authority to use this command. ²⁷ * Security Risk * Revoking all authorities specifically given to a user for an object can result in the user having more authority than before the revoke operation. If a user has USE authority for and object and CHANGE authority on the authorization list that secures the object, revoking USE authority results in the user having CHANGE authority to the object. ²⁸ You must have either ALLOBJ or AUDIT special authority to have the current object auditing value displayed. Otherwise, the value NOTAVL is displayed to indicate that the value is not available for display. ²⁹ You must have either ALLOBJ or AUDIT special authority to retrieve the current object auditing value. Otherwise, the value NOTAVL is returned to indicate that the values are not available for retrieval. ³⁰ See the CHGPGM, CHGSRVPGM, and CHGMOD commands to determine the authority needed to convert programs, service programs, and modules.
³¹ You must have ALLOBJ special authority to specify YES for the PVTAUT parameter. ³² You must have either ALLOBJ or SAVSYS special authority to specify YES for the PVTAUT parameter. ³³ You must have SAVSYS special authority to specify a name for the DFRID parameter. ³⁴ You must have SAVSYS and JOBCTL special authority. ³⁵ Some supported object types may require additional object and library authorities. Refer to the Delete Object (QLIDLTO) API documentation for more information. 36 If you are authorized to the IBM i Database Security Administrator function (QIBM_DB_SECADM) you do not need the specified special authority or the specified authority to the object. However, users authorized to the QIBM_DB_SECADM function cannot grant authority to themselves or transfer ownership to themselves unless they have the authorities required for the operation.