|
As with most special user authorities, the *SAVSYS special authority grants a significant level of additional capability to a user and you should think twice about granting it to anyone.
Any user of the AS/400 has the necessary rights to use the OS/400 SAV* commands. Therefore, they can save any objects they have sufficient authority to. Sufficient authority in this case would be having *OBJEXIST rights to the object. Object existence rights provide authority to control the object's existence and ownership.
By default users have *OBJEXIST rights to all the objects they own. Therefore, they can save any of their own data. They don't have the authority to restore anything, though, because access to the RST* commands are *PUBLIC *EXCLUDE by default.
The *SAVSYS special authority gives a user the additional ability to save objects they don't have *OBJEXIST rights to. One very important implication of this is the fact that when an object is saved, you can also specify that its storage be freed.
IBM's definition of this feature is this: "Freeing storage during a save means that the storage occupied by the data portion of the specified objects being saved is freed as part of the save operation."
In effect, you can remove from the system everything but the header of an object saved in this manner.
Therefore, someone with *SAVSYS authority could do the following:
1. Save any object on the system to a save file specifying that its storage be freed.
2. Delete the save file.
Anyone with *SAVSYS authority has the ability to delete any object from the system. Because this provides so much authority, you may not want anyone but an operator or system administrator to have it.
|
