APSYSEC parameter - Revision history

JDamon: /* Description */

2025-05-09T22:10:56Z

Description

← Older revision		Revision as of 22:10, 9 May 2025
Line 56:		Line 56:
	subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems.</p>		subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems.</p>
	<p>		<p>
	To continue using Model 204's traditional fine-grained control of granting access to run SUBSYSMGMT and DICTADMIN through those subsystems and ~~grant~~		To continue using Model 204's traditional fine-grained control of granting access to run SUBSYSMGMT and DICTADMIN through those subsystems and granting
	control of <var>START</var>, <var>STOP</var>, <var>TEST</var>, and <var>DEBUG</var> privileges, the <var>APSYSEC</var> X'01' bit should <i><strong>not</strong></i> be set.</p></td></tr>		control of <var>START</var>, <var>STOP</var>, <var>TEST</var>, and <var>DEBUG</var> privileges, the <var>APSYSEC</var> X'01' bit should <i><strong>not</strong></i> be set.</p></td></tr>
	</table>		</table>

JDamon: /* Description */

2025-05-09T22:09:21Z

Description

← Older revision		Revision as of 22:09, 9 May 2025
Line 32:		Line 32:
	them access through SUBSYSMGMT and DICTADMIN. When employee turnover		them access through SUBSYSMGMT and DICTADMIN. When employee turnover
	and retirements leave no one with those privileges, new system		and retirements leave no one with those privileges, new system
	managers cannot get access.		managers cannot get access. This option solves that problem.

	In addition to those privileges, the authority to issue START, STOP, TEST and DEBUG		In addition to those privileges, the authority to issue START, STOP, TEST and DEBUG

JDamon: /* Description */

2025-05-09T22:00:33Z

Description

← Older revision		Revision as of 22:00, 9 May 2025
Line 27:		Line 27:

	<td>System managers are allowed to enter SUBSYSMGMT and DICTADMIN without prior authorization. System managers are also allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE).		<td>System managers are allowed to enter SUBSYSMGMT and DICTADMIN without prior authorization. System managers are also allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE).
	~~This~~ saves the effort of adding a system manager to a privileged
			System managers cannot use SUBSYSMGMT or DICTADMIN unless another
			system manager, who has privileges to use those subsystems, gives
			them access through SUBSYSMGMT and DICTADMIN. When employee turnover
			and retirements leave no one with those privileges, new system
			managers cannot get access.

			In addition to those privileges, the authority to issue START, STOP, TEST and DEBUG
			commands saves the effort of adding a system manager to a privileged
	SCLASS in every subsystem in an Online so that the system manager could		SCLASS in every subsystem in an Online so that the system manager could
	at least start and stop the subsystems — a common thing for system		at least start and stop the subsystems — a common thing for system
Line 48:		Line 56:
	subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems.</p>		subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems.</p>
	<p>		<p>
	To continue using Model 204's traditional fine-grained		To continue using Model 204's traditional fine-grained control of granting access to run SUBSYSMGMT and DICTADMIN through those subsystems and grant
	control of <var>START</var>, <var>STOP</var>, <var>TEST</var>, and <var>DEBUG</var> privileges, the <var>APSYSEC</var> X'01' bit should <i><strong>not</strong></i> be set.</p></td></tr>		control of <var>START</var>, <var>STOP</var>, <var>TEST</var>, and <var>DEBUG</var> privileges, the <var>APSYSEC</var> X'01' bit should <i><strong>not</strong></i> be set.</p></td></tr>
	</table>		</table>

JDamon: /* Description */

2025-05-09T17:06:10Z

Description

← Older revision		Revision as of 17:06, 9 May 2025
Line 16:		Line 16:

	==Description==		==Description==
	The <var>APSYSEC</var> parameter makes it possible for a system		The <var>APSYSEC</var> parameter makes it possible for a system manager to enter <var>[[SUBSYSMGMT]]</var> and <var>DICTADMIN ([[Dictionary/204 administration]])</var> without
	manager to <var>[[START command: Starting an application subsystem\|START]]</var>, <var>[[STOP command: Stopping an application subsystem\|STOP]]</var>, <var>[[DEBUG command\|DEBUG]]</var>, or <var>[[TEST command\|TEST]]</var> any subsystem, without having to		prior authorization. It also allows a system manager to <var>[[START command: Starting an application subsystem\|START]]</var>, <var>[[STOP command: Stopping an application subsystem\|STOP]]</var>, <var>[[DEBUG command\|DEBUG]]</var>, or <var>[[TEST command\|TEST]]</var> any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE), without having to
	add the system manager to the [[SCLASS]] authorized to do these things.		add the system manager to the [[SCLASS]] authorized to do these things.

Line 25:		Line 25:
	<table class="thJustBold">		<table class="thJustBold">
	<tr><th>X'01'</th>		<tr><th>X'01'</th>
	<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.
			<td>System managers are allowed to enter SUBSYSMGMT and DICTADMIN without prior authorization. System managers are also allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any PUBLIC or SEMI-PUBLIC subsystem (not PRIVATE).
	This saves the effort of adding a system manager to a privileged		This saves the effort of adding a system manager to a privileged
	SCLASS in every subsystem in an Online so that the system manager could		SCLASS in every subsystem in an Online so that the system manager could

JAL: add links

2016-11-30T17:11:17Z

add links

← Older revision		Revision as of 17:11, 30 November 2016
Line 17:		Line 17:
	==Description==		==Description==
	The <var>APSYSEC</var> parameter makes it possible for a system		The <var>APSYSEC</var> parameter makes it possible for a system
	manager to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem, without having to		manager to <var>[[START command: Starting an application subsystem\|START]]</var>, <var>[[STOP command: Stopping an application subsystem\|STOP]]</var>, <var>[[DEBUG command\|DEBUG]]</var>, or <var>[[TEST command\|TEST]]</var> any subsystem, without having to
	add the system manager to the [[SCLASS]] authorized to do these things.		add the system manager to the [[SCLASS]] authorized to do these things.

Line 27:		Line 27:
	<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.		<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.
	This saves the effort of adding a system manager to a privileged		This saves the effort of adding a system manager to a privileged
	[[SCLASS]] in every subsystem in an Online so that the system manager could		SCLASS in every subsystem in an Online so that the system manager could
	at least start and stop the subsystems — a common thing for system		at least start and stop the subsystems — a common thing for system
	managers to need to do.		managers to need to do.

JAL: /* Description */ add link

2016-11-29T20:48:05Z

Description: add link

← Older revision		Revision as of 20:48, 29 November 2016
Line 17:		Line 17:
	==Description==		==Description==
	The <var>APSYSEC</var> parameter makes it possible for a system		The <var>APSYSEC</var> parameter makes it possible for a system
	manager to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem, without ~~have~~ to		manager to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem, without having to
	add the system manager to the ~~sclass~~ authorized to do these things.		add the system manager to the [[SCLASS]] authorized to do these things.

	For versions of Model 204 prior to 7.5, setting this parameter has no effect at sites not authorized for [[SirSafe]].		For versions of Model 204 prior to 7.5, setting this parameter has no effect at sites not authorized for [[SirSafe]].

JAL: add `s`

2016-11-21T22:57:40Z

add <var>s

← Older revision		Revision as of 22:57, 21 November 2016
Line 17:		Line 17:
	==Description==		==Description==
	The <var>APSYSEC</var> parameter makes it possible for a system		The <var>APSYSEC</var> parameter makes it possible for a system
	manager to START, STOP, DEBUG, or TEST any subsystem, without have to		manager to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem, without have to
	add the system manager to the sclass authorized to do these things.		add the system manager to the sclass authorized to do these things.

JAL: add link

2016-11-21T22:53:28Z

add link

← Older revision		Revision as of 22:53, 21 November 2016
Line 27:		Line 27:
	<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.		<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.
	This saves the effort of adding a system manager to a privileged		This saves the effort of adding a system manager to a privileged
	~~sclass~~ in every subsystem in an Online so that the system manager could		[[SCLASS]] in every subsystem in an Online so that the system manager could
	at least start and stop the subsystems — a common thing for system		at least start and stop the subsystems — a common thing for system
	managers to need to do.		managers to need to do.

JAL at 22:50, 21 November 2016

2016-11-21T22:50:02Z

← Older revision		Revision as of 22:50, 21 November 2016
Line 1:		Line 1:
	{{Template:APSYSEC parameter subtitle}}		{{Template:APSYSEC parameter subtitle}}

	==Summary==		==Summary==
	<dl>		<dl>

JAL: misc formatting

2016-11-21T22:48:53Z

misc formatting

← Older revision		Revision as of 22:48, 21 November 2016
Line 15:		Line 15:

	==Description==		==Description==
	The APSYSEC parameter makes it possible for a system		The <var>APSYSEC</var> parameter makes it possible for a system
	manager to START, STOP, DEBUG, or TEST any subsystem, without have to		manager to START, STOP, DEBUG, or TEST any subsystem, without have to
	add the system manager to the sclass authorized to do these things.		add the system manager to the sclass authorized to do these things.
	~~Setting this parameter has no effect at sites not authorized for [http://m204wiki.rocketsoftware.com/images/4/4d/SafrNew.pdf SirSafe].~~

	The APSYSEC parameter is a bitmask parameter where the bits mean:		For versions of Model 204 prior to 7.5, setting this parameter has no effect at sites not authorized for [[SirSafe]].
	<dl>
	<dt>X'01'		The <var>APSYSEC</var> parameter is a bitmask parameter where the bits mean:
	<dd>System managers are allowed to START, STOP, DEBUG, or TEST any subsystem.		<table class="thJustBold">
			<tr><th>X'01'</th>
			<td>System managers are allowed to <var>START</var>, <var>STOP</var>, <var>DEBUG</var>, or <var>TEST</var> any subsystem.
	This saves the effort of adding a system manager to a privileged		This saves the effort of adding a system manager to a privileged
	sclass in every subsystem in an Online so that the system manager could		sclass in every subsystem in an Online so that the system manager could
Line 30:		Line 31:
	<p>		<p>
	In fact, if no users other than system managers need to start or stop		In fact, if no users other than system managers need to start or stop
	subsystems, this can eliminate the need to even have sclasses in a subsystem		subsystems, this can eliminate the need to even have sclasses in a subsystem to allow starting or stopping of the subsystem.
	to allow starting or stopping of the subsystem.
	In some cases, eliminating this need can reduce the subsystem definition to		In some cases, eliminating this need can reduce the subsystem definition to
	a single default sclass, which has performance benefits — no sclass		a single default sclass, which has performance benefits — no sclass
	lookup is required when a user enters a subsystem, and no sclass-specific		lookup is required when a user enters a subsystem, and no sclass-specific
	~~compiles~~ are done for the procedures in the subsystem.</p>		compilations are done for the procedures in the subsystem.</p>
	<p>		<p>
	Because of the overhead associated with multiple sclasses in a		Because of the overhead associated with multiple sclasses in a
	subsystem (not huge, but possibly measurable), some sites take the risk		subsystem (not huge, but possibly measurable), some sites take the risk
	of adding START and STOP privileges (and perhaps TEST and DEBUG)		of adding <var>START</var> and <var>STOP</var> privileges (and perhaps <var>TEST</var> and <var>DEBUG</var>) to the one and only sclass for a subsystem.
	to the one and only sclass for a subsystem.		This, of course, means that any user can start and stop the subsystem, which might not be ideal from a control or security perspective. </p>
	This, of course, means that any user can start and stop the subsystem, which
	might not be ideal from a control or security perspective. </p>
	<p>		<p>
	The APSYSEC parameter allows such a site to keep one sclass but remove the risk.		The <var>APSYSEC</var> parameter allows such a site to keep one sclass but remove the risk.
	START and STOP privileges can be removed from the default/only sclass for a		<var>START</var> and <var>STOP</var> privileges can be removed from the default/only sclass for a
	subsystem, and only system managers (or users running subsystems that give		subsystem, and only system managers (or users running subsystems that give them system manager privileges) can start or stop subsystems.</p>
	them system manager privileges) can start or stop subsystems.</p>
	<p>		<p>
	To continue using Model 204's traditional fine-grained		To continue using Model 204's traditional fine-grained
	control of START, STOP, TEST, and DEBUG privileges, the APSYSEC X'01' bit		control of <var>START</var>, <var>STOP</var>, <var>TEST</var>, and <var>DEBUG</var> privileges, the <var>APSYSEC</var> X'01' bit should <i><strong>not</strong></i> be set.</p></td></tr>
	should <strong>not</strong> be set.</p>		</table>
	</dl>

	<!-- APSYXMM - Deprecated -->		<!-- APSYXMM - Deprecated -->

APSYSEC parameter - Revision history

JDamon: /* Description */

JDamon: /* Description */

JDamon: /* Description */

JDamon: /* Description */

JAL: add links

JAL: /* Description */ add link

JAL: add s

JAL: add link

JAL at 22:50, 21 November 2016

JAL: misc formatting

JAL: add `s`