Allobj

What is it?

This is the biggy!  All Object Authority. *ALLOBJ  grants the authority to manipulate any object on the system, with the exception of User Profiles, for which *SECADM special authority is required.  *ALLOBJ also allows the user to assign object level authorities, regardless of the authority already placed on the object.  

What are the main exposures?

Every file, program, data area, etc on your system is open to access, manipulation and even deletion.  Delete the Payroll library….. Sure, with *ALLOBJ.

A user with *ALLOBJ, can submit a batch job that specifies another  powerful user  profile to accomplish ANY system function. So, for example,  even if you don’t assign *SECADM special authority to a user that has *ALLOBJ,  that user can still submit a batch job using a profile that does have *SECADM, and create and manipulate user profiles.