Technical data

Security Considerations
12.6 Creating Access Control Lists
ACE Description
Identifier ACE Controls the types of access allowed to specific users based on the
user’s identification. Each Identifier ACE includes one or more
rights identifiers and a list of the types of access the user holding
the identifier has permission to exercise. See Section 12.6.2 for a
summary of identifiers.
For example, the following ACE grants the user Jones read, write, and
execute access to an object:
(IDENTIFIER=[ACCOUNTING,JONES],ACCESS=READ+WRITE+EXECUTE)
Default
Protection ACE
Allows you to specify a protection code for a directory file that
is propagated to all files created within that directory and its
subdirectories.
For example, the following ACE assigns a protection code to newly
created files in a directory. The code gives users in the system and
owner categories full access, it gives group users both read and execute
access, and it denies access to users in the world category.
(DEFAULT_PROTECTION,S:RWED,O:RWED,G:RE,W:)
Creator ACE Adds an extra ACE to the ACL of a file created within the directory to
which you assign the Creator ACE. The Creator ACE applies when the
file being created is not owned by the user identification code (UIC) of
the process creating the file, such as when the directory is owned by a
resource identifier.
The following ACE, for example, specifies that any user creating a file
in the directory will receive read, write, execute, and delete access to it:
(CREATOR,ACCESS=READ+WRITE+EXECUTE+DELETE)
The Creator ACE applies to directory files only.
Security Alarm
ACE
Allows you to request that a security alarm message be sent to the
operator’s terminal if an object is accessed in a particular way.
For example, the following ACE causes an alarm message whenever a
particular file is successfully read:
(ALARM=SECURITY,ACCESS=SUCCESS+READ)
The security Alarm ACE has no effect unless ACL alarms are enabled
with the following command:
$ SET AUDIT/ALARM/ENABLE=(ACL)
Security Audit
ACE
Specifies the access criteria that cause a security alarm message be
sent to the system security audit log file if an object is accessed in a
particular way.
For example, the following ACE causes an alarm message whenever a
particular file is successfully read:
(AUDIT=SECURITY,ACCESS=SUCCESS+READ)
A message is recorded only if ACL audits are enabled with the DCL
command SET AUDIT/AUDIT/ENABLE=ACL.
12–10 Security Considerations