This is more or less what I did to accomplish this: Define a group of users. Create a user specifically for the file, so that only that user has access. Then, give that user no password and an invalid login shell. So you have an account that cannot be su-ed into. Then, use sudo to allow people in a certain group to run commands as that user -- but only the commands you want to allow, only in the exact way you want to allow. Essentially, users would then be able to run the .sas code without actually being able to read the file themselves. Note: The main hurdle I faced was the pointlessness of SAS password encryption as noted by Jaap Karman. Although the password could not be understood, it could still be copy/pasted into other SAS login codes to run jobs as that user.
... View more
