CL Command Reference - CHGAUT
CL Command List > CHGAUT Reference
Description:
The Change Authority (CHGAUT) command is used to change a user¡¯s authority for the object or group of objects named in this command. An object name pattern can be used to change authority for a group of related objects.
The CHGAUT command can also be used to change the authority of a directory tree where the directory, its contents, and the contents of all of its subdirectories are to have the authority changed. If SUBTREE(*ALL) is specified, this command will attempt to change the authority of all objects within the subtree. A diagnostic message will be sent for each object that could not have its authority changed and, when all of the objects have been attempted, an escape message will be sent. If all of the objects had their authority changed with no errors, a completion message will be sent.
If a symbolic link object is encountered, either specified in the Object (OBJ) parameter or encountered in the processing of a subtree, the value specified for the Symbolic link (SYMLNK) parameter will be applied to that symbolic link object. If processing a subtree, the processing of that branch of the subtree then stops because a symbolic link object itself cannot have subtrees.
Authority can be given to:
. Named users
. PUBLIC users who do not have authority specifically given to them either for the object or for the authorization list
. The NetWare Inherited Rights Filter for the file (used only by the QNetWare file system)
. Groups of users who do not have any authority to the object or are not on the authorization list that secures the object v Users on an established authorization list.
. Users on an established authorization list.
The AUTL value on the DTAAUT parameter specifies the authority for the following users:
. Users who do not have authority specifically given to them for an object
. Users who are not on the authorization list that secures the object
. Users whose groups do not have authority specifically given to it
. Users whose groups are not on the authorization list that secures the object.
DTAAUT(*AUTL) is allowed only with USER(*PUBLIC). User profiles cannot be secured by an authorization list.
Restrictions:
. When doing subtree processing, you must also have read (*R) and execute (*X) authorities to the path name and all subdirectories within that path.
. If changing authority for an object in the QSYS.LIB or independent ASP QSYS.LIB file system:
1. A user must either be the owner of the object or have all object (*ALLOBJ) special authority to use this command on an object.
2. This command must get an exclusive lock on a database file before read or object operational authority can be given to a user.
3. If a user requests authority for another specified user to a device currently in use by another authorized user, authority to the device is not given.
4. This command should not be used to change the authority for an authorization list object (/QSYS.LIB/authorization-list-name.AUTL).
5. DTAAUT(*AUTL) is valid only with USER(*PUBLIC).
6. Before you give authorities to use a device, controller, or line description, its associated device, controller, or line must be varied on.
7. For display stations or for work station message queues associated with the display station you can either: (1) enter this command at the device for which authorities are to be granted or (2) precede this command with the Allocate Object (ALCOBJ) command and follow this command with the Deallocate Object (DLCOBJ) command.
Examples:
Example 1: Changing authority to all users
CHGAUT OBJ(¡¯/QSYS.LIB/USERLIB.LIB/PROGRAM1.PGM¡¯)
USER(*PUBLIC) DTAAUT(*RW)
This command gives authority to use and change the object named PROGRAM1 to all users of the system who do not have authorities specifically given to them, who are not on an authorization list, whose user groups do not have authority to the object, or whose user groups are not on the authorization list. The object is a program (*PGM) located in the library named USERLIB. Because the OBJAUT parameter is not specified, any object authorities *PUBLIC already has remain.
Example 2: Changing authority to users on authorization List
CHGAUT OBJ(¡¯/QSYS.LIB/MYLIB.LIB/PRGM3.PGM¡¯) AUTL(KLIST)
This command gives to users the authority specified for them on authorization list KLIST for the object named PRGM3. The object is a program located in library MYLIB.
Example 3: Changing authority of a symbolic link when SYMLNK(*NO)
CHGAUT OBJ(¡¯/sym1¡¯) USER(JOEUSER) DTAAUT(*RX)
SUBTREE(*ALL) SYMLNK(*NO)
This command will first determine if there are subtrees to process. Since the object specified in the OBJ parameter is a symbolic link, the SUBTREE parameter will be ignored because a symbolic link object does not have subtrees. Next, the object pointed to by symbolic link sym1 (dir1) will be changed because the SYMLNK parameter specifies that the symbolic link object not be changed.
In this example, JOEUSER¡¯s authority to dir1 is changed. It does not change JOEUSER¡¯s authority to the symbolic link object (sym1) and it does not change JOEUSER¡¯s authority to the contents of dir1.
Example 4: Changing authority of a symbolic link when SYMLNK(*YES)
CHGAUT OBJ(¡¯/sym1¡¯) USER(JOEUSER) DTAAUT(*R) OBJAUT(*OBJMGT)
SUBTREE(*ALL) SYMLNK(*YES)
This command will first determine if there are subtrees to process. Since the object specified in the OBJ parameter is a symbolic link, the SUBTREE parameter will be ignored because a symbolic link object does not have subtrees. Next, the symbolic link object (sym1) will be changed because the SYMLNK parameter specifies that the symbolic link object be changed.
In this example, JOEUSER¡¯s authority to sym1 is changed. It does not change JOEUSER¡¯s authority to the object pointed to by the symbolic link (dir1) and it does not change JOEUSER¡¯s authority to the contents of dir1.
Example 5: Changing authority of a directory when SUBTREE(*ALL) and SYMLNK(*NO)
CHGAUT OBJ(¡¯/dir1¡¯) USER(JOEUSER) DTAAUT(*R) OBJAUT(*OBJMGT)
SUBTREE(*ALL) SYMLNK(*NO)
This command will first determine if there are subtrees to process. Since the object specified in the OBJ parameter is a directory, the subtrees will be processed. When the processing of the tree encounters a *SYMLNK object, the value for the SYMLNK parameter will be applied to that *SYMLNK object. When the SYMLNK parameter is *NO, the object the symbolic link points to will be changed. The processing of that branch of the tree then stops because the *SYMLNK object itself does not have a subtree.
In this example, JOEUSER¡¯s authority to dir1, dir2.1, dir2.2, dir2.3, dir3.1, dir3.2, dirA is changed. It does not change JOEUSER¡¯s authority to sym3.3, dirB.1, dirB.2, dirB.3.
Example 6: Changing authority of a directory when SUBTREE(*ALL) and SYMLNK(*YES)
CHGAUT OBJ(¡¯/dir1¡¯) USER(JOEUSER) DTAAUT(*R) OBJAUT(*OBJMGT)
SUBTREE(*ALL) SYMLNK(*YES)
This command will first determine if there are subtrees to process. Since the object specified in the OBJ parameter is a directory, the subtrees will be processed. When the processing of the tree encounters a *SYMLNK object, the value for the SYMLNK parameter will be applied to the *SYMLNK object. When the SYMLNK parameter is *YES, the symbolic link object will be changed. The processing of that branch of the tree then stops because the *SYMLNK object itself does not have a subtree.
In this example, JOEUSER¡¯s authority to dir1, dir2.1, dir2.2, dir2.3, dir3.1, dir3.2, sym3.3 is changed. It does not change JOEUSER¡¯s authority to dirA, dirB.1, dirB.2, dirB.3.
Example 7: Changing authority of a directory when SUBTREE(*NONE) and SYMLNK(*NO)
CHGAUT OBJ(¡¯/dir1¡¯) USER(JOEUSER) DTAAUT(*R) OBJAUT(*OBJMGT)
SUBTREE(*NONE) SYMLNK(*NO)
This command will not process subtrees. Since the object specified in the OBJ parameter is not a symbolic link, the SYMLNK parameter will be ignored.
JOEUSER¡¯s authority to dir1 is changed.
NOTE: The only way to change dirB.1, dirB.2, and dirB.3 is to specify them individually in the OBJ parameter of the change command, or to specify the change command with OBJ(dirA) and SUBTREE(*ALL).