HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

• unlink: Controls the ability to delete objects. This
applies to directory objects only. This is inherited by
all directories under the specified directory.
• nsearch: Controls the ability to search for an element
if the file_object is a directory. This attribute is
not inherited by subdirectories.
file_object The full path name of the file or directory.
For example:
/* deny all permissions except read to entire system */
perm read /
/* except for this directory */
perm read,write,create,unlink /var/opt/server
/* just read and write log files, not create them */
perm read,write /var/opt/server/logs
NOTE: To grant any permission on a file system object, the compartment must have
a minimum of read permission on every directory above that object. For example, to
grant read and write permissions on /var/opt/tmp/file1, you must grant read
permissions on /var/opt/tmp, /var/opt, /var, and /.
6.4.3 IPC Rules
Interprocess communication (IPC) rules govern how processes use interprocess
communication methods between compartments. IPC communication methods include
direct process-to-process communication or shared access to an IPC object. When an
object is associated with a process, the object exists in the same compartment as the
process that created it. You define compartment rules to describe the relationship
between the process accessing the object and the object being accessed. When the rule
describes two processes communicating with each other, you treat the second process
as an object. The default behavior for IPC objects is that all operations between different
compartments are prohibited unless explicitly allowed by a rule.
There are two types of IPC rules. The syntax for the first rule type is as follows:
(grant|access) (pty|fifo|uxsock|ipc) compartment_name
where:
Access Specifies whether the rule is object-centric or subject-centric.
The options are:
• grant: Specifies an object-centric rule. This rule allows
processes in the compartment compartment_name to
116 Compartments