IBM Power Ideas Portal


This portal is to open public enhancement requests against IBM Power Systems products, including IBM i. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Under review
Workspace IBM i
Categories Save and Restore
Created by Guest
Created on Jan 26, 2025

RELATED IDEAS

Authority *SECADM and *ALLOBJ needed with RST command

Restoring Ifs objects using RST puts in the joblog a CPDA088 and a CPF9898 for each object restored. The messages text is:

"THE OBJECT IDENTIFIED BY THE PRECEDING CPDA088 MESSAGE WAS RESTORED, BUT THE *RUNEXIT AND/OR *CRTRUNEXIT ATTRIBUTES WERE NOT RESTORED. *ALLOBJ AND *SECADM SPECIAL AUTHORITY IS REQUIRED TO RESTORE THE ATTRIBUTES. A USER WITH THE REQUIRED SPECIAL AUTHORITY CAN USE THE CHGATR COMMAND TO CHANGE THE ATTRIBUTE(S) FOR THE OBJECT."


To avoid the problem we switch to a profile with SECDAM and ALLOBJ but granted the rights over the profile to low profile user is a security concern. Using normal profiles makes the joblog unreadable and useless.


Idea priority High
  • Guest
    Dec 19, 2025
    Beginning with IBM i 7.5, *ALLOBJ and *SECADM special authorities are required to restore the *RUNEXIT and *CRTRUNEXIT attributes associated with IFS objects. When a user without these elevated authorities restores an IFS object, the object itself is restored successfully; however, the *RUNEXIT and *CRTRUNEXIT attributes are intentionally omitted. In these cases, an informational message is issued for each affected object to inform the user that the attributes were not restored.

    This behavior was implemented deliberately and with full awareness of the potential impact on customers. The decision reflects a conscious move toward a more secure default posture for the IBM i operating system as a whole. Because *RUNEXIT and *CRTRUNEXIT attributes are commonly used to mitigate or prevent security vulnerabilities, requiring a higher level of authority to restore them helps ensure that these protections cannot be unintentionally or inappropriately reintroduced.

    To improve transparency, the published documentation will be updated in the near future to explicitly note the elevated authority requirements for restoring these attributes beginning with IBM i 7.5. The relevant documentation can be found here:

    https://www.ibm.com/docs/en/i/7.5.0?topic=information-restrictions-when-using-rst-command

    - IBM Power Systems Devlepment
    Reply
  • Admin
    Carmelita Ruvalcaba
    Dec 16, 2025

    The CAAC has reviewed this IBM Idea and recommends that IBM not implement this request.

    The recommendation is to use a secondary profile that has the required authority.

    Background: The COMMON Americas Advisory Council (CAAC) members have a broad range of experience in working with small and medium-sized IBM i customers. CAAC has a key role in working with IBM i development to help assess the value and impact of individual IBM Ideas on the broader IBM i community and has therefore reviewed your Idea.

    For more information about CAAC, see www.common.org/caac

    Carmelita Ruvalcaba - CAAC Program Manager

    1 reply
  • Guest
    May 15, 2025
    This is working as designed in IBM i 7.5. When restoring an IFS object from a user without *ALLOBJ and *SECADM, the CRTRUNEXIT and RUNEXIT attributes cannot be restored in that case. At IBM i 7.6, the CPDA088 and CPF9898 messages are replaced by a new informational message CPIA0AC.

    - IBM Power Systems Development
    Reply

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.