Software Distributor Administration Guide (March 2009)

There may be many user, group, and host type entries per ACL, while there may
be only one of each of object_owner, object_group and any_other. There may
be at most one local (i.e., no key) other entry and an unlimited number of remote (i.e.,
keyed) other entries.
9.5.1 ACL Keys
The second part of the ACL entry is the key. The table below lists the possible key
values for specific entry types.
Table 9-4 SD-UX ACL Entry Key Values
Key ContentEntry Type
a user name [optionally, @ remote-host]user
a group name [optionally, @ remote-host]group
a host name
host
[optionally, @ remote-host]other
no key allowed
any_other
When listing the ACL, the remote-host is printed in its Internet address form (e.g.,
15.12.89.10) if the local system cannot resolve the address from its host lookup
mechanism (DNS, NIS, or /etc/hosts). The remote-host must be recognized
(resolvable) when used in the -M and -D options. Unrecognized remote-host values
are accepted in files provided with the -F option.
9.5.2 ACL Permissions
There are five different permissions grantable by the ACL: crwit.
Table 9-5 ACL Permissions
Permission to edit or change the ACL.
control (c)
Permission to test access to an object (i.e., read the ACL).
test (t)
Permission to install a new product, depot or root.
insert (i)
Permission to change a host, depot, root or product.
write (w)
Permission to list depot, roots and products and attributes.
read (r)
In the ACL entry, these permissions are abbreviated c, t, i, w, and r. To grant all
permissions, you may use the shorthand letter a instead of the crwit to denote all
permissions.
The meaning of permissions is different for different types of objects, and the
permissions do not have to appear in any specific order. Roots do not provide product
level protection, so all permissions on products installed on roots are controlled by the
ACL protecting the root itself.
9.5 ACL Entries 197