Allow restore for security-sensitive objects

Three system values, Verify Object on Restore (QVFYOBJRST), Force Conversion on Restore (QFRCCVNRST), and Allow Object Restore (QALWOBJRST), act as a series of filters to determine whether a program is restored without change, whether it is re-created as it is restored, or whether it is not restored to the system.

The QVFYOBJRST system value determines whether objects are required to have digital signatures to be restored to your system. You can prevent anyone from restoring an object, unless that object has a correct digital signature from a trusted software provider.

The QFRCCVNRST system value allows you to specify whether to convert the following object types during a restore:

Program (*PGM)
Service program (*SRVPGM)
Module (*MODULE)
SQL Package (*SQLPKG)

The QALWOBJRST system value determines whether objects that are security-sensitive may be restored to your system. You can use it to prevent anyone from restoring a system state object or an object that adopts authority.

Before running a restore operation, you must plan what type of restore you want to perform. Then, configure your system values to the proper settings to meet your needs. Then, when a restore operation is performed, you will have the correct settings specified on your system. To plan how you want objects restored on the system, answer the following questions based on your company's needs:

How cautious do you want to be about what is restored?
What objects do you want to allow to be restored?

For more information on using these restore system values, see the following sections in Chapter 3 of the iSeries Security Reference:

"Verify Object on Restore (WVFYOBJRST)"
"Force Conversion on Restore (QFRCCVNRST)"
"Allow Restoring of Security-Sensitive Objects (QALWOBJRST)"

Scan objects that are accessed after a restore operation:

The *NOPOSTRST value of the system value, QSCANFSCTL, impacts whether or not objects are scanned after a restore operation. Do you want to scan objects on the next access after the restore is complete? You need to consider what objects you are restoring and what kind of performance impact the scan will cause. Before determining whether or not to scan objects consider the following: Scanning may not be necessary if you are restoring your own objects which were saved with the option to scan objects and not save objects that failed the scan. Scanning may not be necessary if you are restoring objects that are coming from a trusted source.