Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

Table Of Contents
the depot can be more widely opened to insertion because users with insert permission can only
copy in new products or delete their own products: you don’t have to worry about a user erroneously
deleting some critical product that they shouldn’t control.
The rationale for this protection scheme is borrowed from a mechanism introduced in the BSD file
system. With write permissions on a BSD directory, you may create a file in the directory. If the
sticky mode bit is set on the directory, only the file owner, the directory owner, or superuser may
remove or rename the file.
For example: In /tmp, owned by root, with “wide-open” write permission and the sticky bit set
manually (i.e., mode 1777), anyone can create files that nobody else (except themselves and
superuser) can remove. This makes /tmp a more secure place to store temporary work because
someone else can’t delete your files there.
Installing or copying from an unregistered depot requires the user and the target agent’s host to
have insert permission on the depot’s host. If this permission is denied to the target’s host, the
depot’s daemon log will contain the message:
ERROR: Access denied to SD agent at host lucille on
behalf of rob@lucille to start agent on unregistered
depot "/users/rob/depot." No (i)nsert permission on
host.
07/23/01 15:51:06 MDT
This message indicates it is the agent at lucille that did not have insert permission on the depot’s
host, not the user rob@lucille.
The remote host ACL must have two entries granting insert permission: one for the user, and one
for the target host.
For example, for user rob to be allowed to install a product on target host lucille from an
unregistered depot on source host desi, the command
swacl -l host @ desi
must show the minimum ACL entries
user:rob@lucille:-i-
host:lucille:-i-
Rob could alternatively register the depot with the swreg command with only the first entry above
before running swinstall or swcopy.
Host System ACLs
The host system is the highest level of protected object in SD-UX. A host ACL protects each host
system, controlling permission to create depots and roots. The host ACL may grant the following
permissions:
Table 40 Host ACL Permissions
Permission to obtain host attributes, including a list of depots and roots on the host.r (read)
Permission to change the host object.w (write)
Permission to create and register a new depot or root on the host.i (insert)
Permission to edit or change the ACL.c (control)
Permission to test access to an object and list the ACL.t (test)
A sample host-system ACL grants depot and root source creation, source listing, and ACL
administration to a user named rob and give open permission to list the depots and roots on the
host, would be:
user:rob:r-ic-
any_other:r
Since any_other does not havet (test) permission, only rob can list this ACL, because he has
c (control permission).
ACL Entries 153