Software Distributor Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (5900-2561, March 2013)

Thus, there are three ACLs on the host:
• Host ACL
Attached to and controlling access to the host object itself.
• Container ACL Template (global_soc_template)
Used to initialize the ACL protecting new depots and roots created on the host.
• Product ACL Template (global_product_template)
The ACL that is used to initialize the product ACL template on depots that are created on the
host.
There are also two ACLs on product depots:
• The depot’s ACL that is used to determine permissions on the depot.
• The depot’s product ACL template (product_template) that is used to initialize the ACLs
protecting new products on the depot.
There is one ACL on the installation (root):
• The root ACL that protects the root and products installed on it.
And finally, there is one ACL on the product:
• The product’s ACL that is used to determine permissions on the product.
Every host must have an ACL protecting it and a pair of template ACLs (product and container) to
provide initialization data for implicit depot and product ACLs. All three are created when SD-UX
is installed on the host.
9.5.4.1 Default ACL Template Entries
The host system’s container ACL template dictates initial permissions on all depots and roots that
are introduced on that host. The host also contains a master copy of a product ACL template, which
is copied to each new depot.
A default set of host ACLs is provided at the time SD-UX is installed that can be altered by the
SD-UX administrator. The contents of these host-system ACLs immediately after SD-UX installation
are:
Host ACL
• The host ACL below allows global (any_other) permission to list the depots and roots on
the host:
object_owner:swadm:crwit
any_other:-r---
NOTE: Remember, the local superuser always has all permissions, even without an ACL entry.
9.5.4.1.1 Container ACL Template
• The container ACL template below grants the owner or creator (object_owner) of a new
depot or root permission to manage that new depot or root and to change its ACL. It also
grants global permission (any_other) to list products in the new depot or root.
object_owner:crwit
any_other:-r---
9.5.4.1.2 Product ACL Template
• The product ACL template below grants permission to perform all operations on products
installed on Depots on this host to the respective creator (i.e., owner), via the object_owner
160 SD-UX Security