> On our test system, we move SHUTDOWN to class S (or whatever). Then SET > PRIVCLAS * +S is required to kill the first-level system. I've thought, > too, about giving ESMs control over SHUTDOWN.
Sounds like a very good idea to implement generically for the next release of VM. Having SHUTDOWN bunched in with all the other class A commands has always been a loaded automatic without a safety. In fact, does OPERATOR really need anything but C and G for normal operations? B would be convenient, but thinking about this as a more general lockdown and cleanup, it might be worth tightening things up a bit now that we're not really doing apps on CMS any more.
