Software Distributor Administration Guide (March 2009)

The rationale for this protection scheme is borrowed from a mechanism introduced in
the BSD file system. With write permissions on a BSD directory, you may create a file
in the directory. If the sticky mode bit is set on the directory, only the file owner, the
directory owner, or superuser may remove or rename the file.
For example: In /tmp, owned by root, with “wide-open” write permission and the
sticky bit set manually (i.e., mode 1777), anyone can create files that nobody else (except
themselves and superuser) can remove. This makes /tmp a more secure place to store
temporary work because someone else can’t delete your files there.
Installing or copying from an unregistered depot requires the user and the target agent’s
host to have insert permission on the depot’s host. If this permission is denied to the
target’s host, the depot’s daemon log will contain the message:
ERROR: Access denied to SD agent at host lucille on
behalf of rob@lucille to start agent on unregistered
depot "/users/rob/depot." No (i)nsert permission on
host.
07/23/01 15:51:06 MDT
This message indicates it is the agent at lucille that did not have insert permission
on the depot’s host, not the user rob@lucille.
The remote host ACL must have two entries granting insert permission: one for the
user, and one for the target host.
For example, for user rob to be allowed to install a product on target host lucille
from an unregistered depot on source host desi, the command
swacl -l host @ desi
must show the minimum ACL entries
user:rob@lucille:-i-
host:lucille:-i-
Rob could alternatively register the depot with the swreg command with only the first
entry above before running swinstall or swcopy.
9.5.3.1 Host System ACLs
The host system is the highest level of protected object in SD-UX. A host ACL protects
each host system, controlling permission to create depots and roots. The host ACL may
grant the following permissions:
Table 9-7 Host ACL Permissions
Permission to obtain host attributes, including a list of depots and roots on the host.
r (read)
Permission to change the host object.
w (write)
Permission to create and register a new depot or root on the host.
i (insert)
Permission to edit or change the ACL.
c (control)
Permission to test access to an object and list the ACL.
t (test)
9.5 ACL Entries 199