HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

various parts of the system. The compartments on the system are configured so that
the processes can access the resources they need.
Figure 6-1 Compartment Architecture
process
process relationship
files and/or directories
file access
network
IPC
signals
Compartment
recorder
All
logs
spool
/
/var/opt/server
parent
Network
read
read, write
read, write
handler
handler
handler
server_parent
server_children
lan cmpt 1
In Figure 6-1, the parent process is configured in a compartment, compartment A. As
part of its functioning, the parent process spawns a number of handler processes in a
different compartment, compartment B. The handler processes inherit the compartment
configuration of the parent process. The network card that connects this system to the
LAN is configured in another compartment, compartment C. The file system is
configured to allow full access to compartment A, but only allow partial access to
compartment B. Communication between the system components in their separate
compartments is configured as follows:
• All handler processes are configured to communicate with the network.
• The recorder can access the file system.
• The handler processes have read, and read/write access to parts of the file system.
110 Compartments