Software Distributor Administration Guide (March 2009)

Product level protection is provided on depots in this way: the depot’s ACL protects
the depot itself while product ACLs protect the products within the depot.
The table below summarizes SD-UX object permissions and ACLs to which they may
be applied.
Table 9-6 SD-UX ACL Permission Definitions
Allows You To:Permission
Product on DepotDepotRootHost System
Edit all ACLs
c (control)
Test access to an object, read (list) the ACL itself
t (test)
N/AInsert a new
product
Insert a new productInsert a new depot
or root
i (insert)
Change productChange depotChange root or
products
Change host
w (write)
1
Read product filesList depot and
product attributes
List root and
product attributes
List depots and
roots
r (read)
2
1 Write permission means permission to change or delete the object, except the host source object may
not be deleted.
2 Read permission on containers (i.e., hosts, roots, and depots) lets a user list the container contents; on
products within depots, read permission lets a user copy or install the product.
9.5.3 Object Protection
The control of product insert and delete permissions differs between roots and depots.
The permission for anyone to insert or delete a product on a root is contained within
the root’s ACL. If you have write permission on a root, you can change or delete any
product on that root; there is NO product level control on roots.
The depot ACL controls insertion (creation) of new products, while the inserted object
has its own ACL that controls modification and deletion. This lets the creator (owner)
of a product on a depot change or delete the product without requiring the broader
write permission that could affect other users’ products on the same depot.
This is useful for product control, because it lets you assign management control for a
specific product to a delegated administrator. Also, when a product is created on a
depot, the user and group identity of the creator is recorded in the product information.
If the product ACL contains an object_owner entry granting write permissions to
the owner, then the product creator will automatically have rights to change or delete
the product. Therefore, the depot can be more widely opened to insertion because users
with insert permission can only copy in new products or delete their own products:
you don’t have to worry about a user erroneously deleting some critical product that
they shouldn’t control.
198 SD-UX Security