Technical data

Using Files and Directories
10.5 Protecting Files
tape volume. See the description of initializing magnetic tape volumes in
Section 9.3.
The next example illustrates how you can use the SHOW PROTECTION
command to display the default protection characteristics for disk files.
Example
$ SHOW PROTECTION
SYSTEM=RWED, OWNER=RWED, GROUP=RE, WORLD=NO ACCESS
In this example, the SHOW PROTECTION command requests a display of the
current protection defaults.
10.5.3 Protecting Disk Files
Each file on a disk has its own protection code, which is distinct from the
protection that applies to the disk volume itself. Files residing on disk volumes
have the access types shown in Table 10–2.
Table 10–2 Access Types with Disk File Protection
Access Type Gives you the right to...
Read Read, print, or copy a disk file. Read access automatically includes execute
access to a specified file or group of files on disk.
Write Write to or change the contents of a file, but not delete it. Write access
allows modification of the file characteristics that describe the contents of
the file.
Execute Execute a file that contains an executable program image or DCL
command procedure.
Delete Delete the file. To delete a file, you must have delete access to the file and
write access to the directory that contains the file.
Control Change file characteristics, including the protection code and ACL. Special
restrictions apply to changing the owner of a file.
If you do not define a protection code for a file when you create it, the system
applies default protection. If a version of the file already exists, protection is
taken from the previous version.
For a new file, the system determines protection in two major ways:
• If the directory where the file is to be cataloged has an associated access
control entry (ACE) that specifies the default protection, the system uses the
specified protection.
• If the directory does not have the default protection ACE, the system uses
the default process protection. You establish the default process protection
explicitly with the SET PROTECTION/DEFAULT command, or by default
when you log in.
For disk volumes, each file on the volume can have a different protection
associated with it. The SET SECURITY/PROTECTION command and other
file-manipulating commands allow you to define the protection for individual files.
Note
To protect a file completely, you must protect both the file itself and the
directory that lists the file. To protect a file against unauthorized access,
Using Files and Directories 10–15