Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

In SD-UX, objects are protected by ACLs. An ACL is a structure, attached to an object, that defines
access permissions for multiple users and groups. It extends the concepts defined by the HP-UX file
system mode bits in two ways: by allowing specification of the access rights of many individuals
and groups instead of just one of each; and by protecting entire SD-UX objects, rather than individual
files.
Generally, a controller requests an agent to perform some operation on a object. SD-UX protects
each host, depot, depot-product, and installation object (root) with an ACL. After a call is
authenticated, the ACL manager is consulted for a caller’s access permissions to a protected object
before allowing the action.
SD-UX authorization uses ACLs to determine the RPC caller’s rights to access a particular SD-UX
object in a particular way (i.e., read, write). An object’s ACL is searched for an entry that matches
the caller. Once a matching entry is found, the permissions granted in that entry are compared to
those required for the operation. If permissions required for the operation are all granted by the
entry, access is authorized, and SD-UX proceeds with the requested operation.
How Agents Handle Controller Requests
When a controller requests an agent to do an operation requiring the participation of another
agent, the two agents must each grant access to the objects under their control before the operation
can complete.
Figure 57 SD-UX Security Process
For example, to install a product P from depot D to root R:
1. User U sends an RPC request to swagentA on the target host H. User U wants to install the
product in root R (on the target host).
2. SwagentA checks the ACL protecting root R to confirm that user U is authorized to insert
products.
3. SwagentA (running as principal H) forms a request to swagentB (running where depot D
resides) to read the product.
4. SwagentB checks the ACL protecting the product to make sure that both the destination system
(principal H) and the user U have read permission before honoring the request, and the
installation proceeds.
The ACL on swagentB neither knows of nor depends on user U. The ACL on root R acts to screen
U; then (and only then) the product’s ACL acts to screen H.
As a special case, the superuser always has full permissions on a local system.
160 SD-UX Security