HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

sealed compartment server_children {
/* Deny all access to any file system objects ... */
permission none /
}
NOTE: The INIT compartment name is not case sensitive. INIT, init, and Init
are all treated as the same compartment by the system.
Compartment specifications are preprocessed with cpp() before parsing begins. This
is why you use cpp() directives such as #include, #define, #ifdef, and C-style
comments to organize and document rules files.
6.4.2 File System Rules
File system rules govern access by processes to files and directories on the system. File
system rules are inherited from a parent directory to all subdirectories and files within
the parent, unless an explicit rule overrides inheritance.
By default, if no permissions are specified, all permissions are granted for a file system
object.
The syntax for file system rules is as follows:
(permission|perm) permission_list file_object
where:
permission or perm
Sets permissions for a file or directory.
permission_list The types of permission you can apply to a file or directory
are:
• none: Denies all permissions to a file or directory.
• read: Controls the read access to the object. If the
object is a file, reading and executing the file is
controlled. If the object is a directory, searching and
listing the directory is controlled. Additionally, due
to inheritance, reading of all files under the directory
is controlled. Files must have read access in order to
be opened for execution.
• write: Controls the write access to the object. If the
object is a file, writing to the file is controlled. If the
object is a directory, due to inheritance, writing for
all files under the directory is controlled.
• create: Controls the ability to create objects. This
applies to directory objects only. This is inherited by
all directories under the specified directory.
6.4 Compartment Rules and Syntax 115