HP-UX 11i Security Containment Administrator's Guide for HP-UX 11i v2

For example:
/* deny all permissions except read to entire system */
perm read /
/* except for this directory */
perm read,write,create,unlink /var/opt/server
/* just read and write log files, not create them */
perm read,write /var/opt/server/logs
permissionor perm
Sets permissions for a file or directory.
permission_list The types of permission you can apply to a file or directory are:
• none: Denies all permissions to a file or directory.
• read: Controls the read access to the object. If the object is a file,
reading and executing the file is controlled. If the object is a
directory, searching and listing the directory is controlled.
Additionally, due to inheritance, reading of all files under the
directory is controlled. Files must have read access in order to
be opened for execution.
• write: Controls the write access to the object. If the object is a file,
writing to the file is controlled. If the object is a directory, due
to inheritance, writing for all files under the directory is
controlled.
• create: Controls the ability to create objects. This applies to
directory objects only. This is inherited by all directories under
the specified directory.
• unlink: Controls the ability to delete objects. This applies to
directory objects only. This is inherited by all directories under
the specified directory.
file_object The full path name of the file or directory.
NOTE: To grant any permission on a file system object, the compartment must have a minimum
of read permission on every directory above that object. For example, to grant read and write
permissions on /var/opt/tmp/file1, you must grant read permissions on /var/opt/tmp,
/var/opt, /var, and /.
IPC Rules
Interprocess communication (IPC) rules govern how processes use interprocess communication
methods between compartments. IPC communication methods include direct process-to-process
communication or shared access to an IPC object. When an object is associated with a process,
the object exists in the same compartment as the process that created it. You define compartment
rules to describe the relationship between the process accessing the object and the object being
accessed. When the rule describes two processes communicating with each other, you treat the
second process as an object. The default behavior for IPC objects is that all operations between
different compartments are prohibited unless explicitly allowed by a rule.
There are two types of IPC rules. The syntax for the first rule type is as follows:
(grant|access) (pty|fifo|uxsock|ipc) <compartment_name>
For example:
64 Compartments