HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

access the specified IPC mechanism in the current
compartment.
• access: Specifies a subject-centric rule. This rule allows
processes in the current compartment to access the
specified IPC mechanism in the compartment
compartment_name.
Method Specifies the method of communication this rule applies to.
The options are:
• pty: Specifies that the rule applies to pty used in
interprocess communication.
• fifo: Specifies that the rule applies to FIFOs.
• uxsock: Specifies that the rule applies to UNIX domain
sockets.
• ipc: Specifies that the rule applies to SYSV and POSIX
IPC objects, such as shared memory, semaphores, and
message queues.
compartment_name The name of the other compartment where processes in this
compartment can communicate with.
For example:
/* allow the children to access UNIX domain */
/* sockets created by the parent compartment */
grant uxsock server_children
The second type of IPC rule governs process access. The syntax for this type of rule is
as follows:
(send|receive) signal compartment_name
where:
Direction Specifies whether processes in the current compartment have
access to view and alter process behavior from another
specified compartment. The options are:
• send: Specifies a subject-centric rule. Allows processes
in the current compartment to send signals and view
process data in the compartment compartment_name.
• receive: Specifies an object-centric rule. Allows
processes in the compartment compartment_name to
send signals and view process data in the current
compartment.
signal
Specifies that this rule applies to signals and process visibility.
compartment_name The name of the other compartment where processes in the
current compartment can have access to view process
information or to be viewed from.
6.4 Compartment Rules and Syntax 117