Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

the SD-UX security provisions for remote operations do not apply to swpackage. See Chapter 9:
“SD-UX Security ” (page 141) for more information on ACLs.
The swpackage command operates as setuid root, that is, the Package Selection phase
operates as the invoking user, the Analysis and Packaging phases operate as the superuser. The
superuser owns and manages all depots and therefore has all permissions for all operations on a
depot. If the depot happens to be on an NFS volume, access problems will not arise from ACLs,
but will arise if the local superuser does not have NFS root access on the NFS mounted file system.
If you are not the local superuser, you will not have permission to create or modify a depot unless
the local superuser grants you permission.
swpackage checks and enforces the following permissions:
1. Can you create a new depot?
Superuser Yes
Other Yes, if the ACL for the local host grants the user “insert” permission, i.e.
permission to insert a new depot into the host.
If the proper permissions are not in place and the depot is a new one,
swpackage terminates with an error.
2. Can you create a new product?
Superuser Yes
Other Yes, if the depot is new and you passed check #1 above or if the ACL for an
existing depot grants you insert permission, i.e. permission to change the
contents of the depot (by adding a new product).
If you are denied authorization to create a new product, swpackage generates
an error message and excludes the product from the session.
3. Can you modify an existing product?
Superuser Yes
Other Yes, if the ACL for the existing product grants you write permission, i.e.
permission to overwrite/change the contents of the product. If you are denied
authorization to change an existing product, swpackage generates an error
message and excludes the product from the session.
If you are denied insert and write permission for all selected products,
swpackage terminates with an error.
4. Can you change the depot-level attributes?
Superuser Yes
Other Yes, if the depot is a new one and you passed check #1 above or if the ACL
for an existing depot grants you write permission, i.e. permission to
write/change the contents of the depot (same as #2 above).
If you are denied authorization to change an existing depot, and if the PSF
specifies some depot-level attributes, then swpackage produces a warning
message and does not change the depot attributes.
ACL Creation
When swpackage creates a new depot or a new product, it also creates an ACL for it:
New depot swpackage creates an ACL for the depot and a template ACL for all the
products that will be packaged into it.
The depot ACL is generated from the host’s global_soc_template ACL (that
is, the template ACL established for new depots and new root file systems).
196 Creating Software Packages