Re: dbaccess Permissions -- scenarios, unproven

[ skipped ... ] : Potential Solutions: : 1) Change dbaccess permissions from: -rwxr-xr-x informix informix : to: -rwxr-x--- informix infmx_user : where the group infmx_user includes only the half dozen people who have : any business executing this program. At the moment this is my preferred : solution. Are there any problems with this scenario I am missing? You must change isql, fglpc, esql-c preprocessor and even cc access rights too ;-) ... But if your application is real executeable file, you can set its access rights to something like srwx--x--- appuser appgrp where appuser is only user having some database privilleges. All the real users of your application belongs to appgrp group and haven't no database privileges at all. If they run your application they can do something in database, but not with dbaccess, isql etc. I suppose there is a way to identify real user id in such an application, but not by means of SQL USER. This approach will work even your application is 4gl p-code. You must only to write program with 's' flag that only executes fglgo with all paraneters. : 2) Write a set of stored procedures which are executed as dba to grant : and revoke privileges every time a user enters or exits a program. : I really don't think this is a very efficient thing to do and I would : prefer to avoid it. IMHO, it's only efficient thing if you wish to restrict rights of users working via I-Net. WBR, Vadim J. Nikitin