Print Adopting Objects (PRTADPOBJ)

The Print Adopting Objects (PRTADPOBJ) command allows you to print a report of the objects that adopt the special and private authorities of the specified user profile. This is a way to check for security exposures associated with program adoption.

Restrictions:

1. You must have *ALLOBJ or *AUDIT special authority to use this command.
2. The user profile specified on the command is locked while the command is running. The lock prevents such things as objects having their owner changed to this profile. If this profile owns a lot of objects, the profile could be locked for an extended period of time.

This command will print two reports for a user profile. The first report (Full Report) will contain all of the objects that adopt the authorities of the user profile. The second report (Changed Report) will contain the objects that now adopt the authorities of the user profile that did not adopt the authorities of the user profile when the PRTADPOBJ command was previously run for the user profile. If the PRTADPOBJ command was not previously run for the user profile, there will be no 'Changed Report'. If the command has been previously run for the user profile but no additional objects adopt the authorities of the user profile, then the 'Changed Report' will be printed but there will be no objects listed.

The reports will contain the following information:

• The name of the user profile.
• The special authorities that the user profile has.
• The date and time the report was last run (shown on Changed Report only).
• An entry for each object that adopts the user profile's authority. Each entry contains the following information:
  • The name of the object.
  • The type of object.
  • The object's *PUBLIC authority. If the object or the object's library is locked at the time the report is created, the value is set to *LOCKED.
  • The name of the library the object is in.
  • The library's *PUBLIC authority. If the library is locked at the time the report is created, the value is set to *LOCKED.
  • An indication of whether there are any private authorities on the object ('Y' or 'N'). If the object or the object's library is locked at the time the report is created, the value is left blank.

Note: If there are no objects that adopt the authority of a user profile, no reports will be printed for that user. If none of the user profiles specified on the command have objects that adopt the authority of the user profiles, then there will be no reports generated.

The file QSECADPOLD in library QUSRSYS contains information from the last time the PRTADPOBJ command was run for a user profile. There is a member within the file, with the same name as the user profile, for each profile that has been previously specified on the command. System file QADPGMAD in library QSYS with format name of QSYPGMAD is the model file for the QSECADPOLD file.

Parameters

User profile (USRPRF)

This is a required parameter.

The name of the user profile whose adopted object information will be printed.

*ALL

The adopted information will be printed for all user profiles.

name

The name of the user profile to print the adopted information for.

generic-name

The generic name of the user profile to print the adopted information for. A generic name is a character string of one or more characters followed by an asterisk (*).

Changed report only (CHGRPTONLY)

Specifies whether just the changed report should be printed.

*NO

The full and changed reports will be printed.

*YES

Only the changed report will be printed.

Examples

PRTADPOBJ   USRPRF(OURSECOFR)

This command prints both full and changed reports for the objects that adopt the special and private authorities of the user profile OURSECOFR.

Error messages

*ESCAPE Messages

CPFB304

User does not have required special authorities.

CPFB307

Command &1 in use in another job.