Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

There are also two ACLs on product depots:
• The depot’s ACL that is used to determine permissions on the depot.
• The depot’s product ACL template (product_template) that is used to initialize the ACLs
protecting new products on the depot.
There is one ACL on the installation (root):
• The root ACL that protects the root and products installed on it.
And finally, there is one ACL on the product:
• The product’s ACL that is used to determine permissions on the product.
Every host must have an ACL protecting it and a pair of template ACLs (product and container) to
provide initialization data for implicit depot and product ACLs. All three are created when SD-UX
is installed on the host.
Default ACL Template Entries
The host system’s container ACL template dictates initial permissions on all depots and roots that
are introduced on that host. The host also contains a master copy of a product ACL template, which
is copied to each new depot.
A default set of host ACLs is provided at the time SD-UX is installed that can be altered by the
SD-UX administrator. The contents of these host-system ACLs immediately after SD-UX installation
are:
Host ACL
• The host ACL below allows global (any_other) permission to list the depots and roots on
the host:
object_owner:swadm:crwit
any_other:-r---
NOTE: Remember, the local superuser always has all permissions, even without an ACL entry.
Container ACL Template
• The container ACL template below grants the owner or creator (object_owner) of a new
depot or root permission to manage that new depot or root and to change its ACL. It also
grants global permission (any_other) to list products in the new depot or root.
object_owner:crwit
any_other:-r---
Product ACL Template
• The product ACL template below grants permission to perform all operations on products
installed on Depots on this host to the respective creator (i.e., owner), via the object_owner
entry, of each product. It also grants permission to read (i.e., install) and test the product to
any host (the any_other entry).
object_owner:crwit
any_other:-r---
• In addition to encompassing all hosts, the any_other entry also applies to all other users
except, in this case, the product’s owner. In SD-UX however, product read permission has
meaning only to host principals, and other possible product permissions never apply to hosts;
therefore, the any_other entry may be overloaded with user and host permissions, if desired,
without any danger of ambiguity. This overloading should be kept in mind when using the
SD-UX to execute solutions.
These host ACL defaults provide a good starting point for control over the management functions
of SD-UX while providing open access to read the software for installation on root targets.
156 SD-UX Security