Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

ACL Permissions
There are five different permissions grantable by the ACL: crwit.
Table 38 ACL Permissions
Permission to edit or change the ACL.control (c)
Permission to test access to an object (i.e., read the ACL).test (t)
Permission to install a new product, depot or root.insert (i)
Permission to change a host, depot, root or product.write (w)
Permission to list depot, roots and products and attributes.read (r)
In the ACL entry, these permissions are abbreviated c, t, i, w, and r. To grant all permissions,
you may use the shorthand letter a instead of the crwit to denote all permissions.
The meaning of permissions is different for different types of objects, and the permissions do not
have to appear in any specific order. Roots do not provide product level protection, so all
permissions on products installed on roots are controlled by the ACL protecting the root itself.
Product level protection is provided on depots in this way: the depot’s ACL protects the depot itself
while product ACLs protect the products within the depot.
The table below summarizes SD-UX object permissions and ACLs to which they may be applied.
Table 39 SD-UX ACL Permission Definitions
Allows You To:Permission
Product on DepotDepotRootHost System
Edit all ACLsc (control)
Test access to an object, read (list) the ACL itselft (test)
N/AInsert a new productInsert a new productInsert a new depot or
root
i (insert)
Change productChange depotChange root or
products
Change hostw (write)
1
Read product filesList depot and product
attributes
List root and product
attributes
List depots and rootsr (read)
2
1
Write permission means permission to change or delete the object, except the host source object may not be deleted.
2
Read permission on containers (i.e., hosts, roots, and depots) lets a user list the container contents; on products within
depots, read permission lets a user copy or install the product.
Object Protection
The control of product insert and delete permissions differs between roots and depots.
The permission for anyone to insert or delete a product on a root is contained within the root’s
ACL. If you have write permission on a root, you can change or delete any product on that root;
there is NO product level control on roots.
The depot ACL controls insertion (creation) of new products, while the inserted object has its own
ACL that controls modification and deletion. This lets the creator (owner) of a product on a depot
change or delete the product without requiring the broader write permission that could affect other
users’ products on the same depot.
This is useful for product control, because it lets you assign management control for a specific
product to a delegated administrator. Also, when a product is created on a depot, the user and
group identity of the creator is recorded in the product information.
If the product ACL contains an object_owner entry granting write permissions to the owner,
then the product creator will automatically have rights to change or delete the product. Therefore,
152 SD-UX Security