Access Control Definition Security (ACD)

the owner of a file is any one of these three users:

The System Manager (SM) is the owner of all of the devices on a system.

• Is the user an owner of the file or device; that is, is the user the creator of the file, the account manager (AM capability), where the file resides or the system manager (SM capability)? If so, permission is granted, and the checking ends.

• If not, is there an ACD associated with the file or device?

  • If there is no ACD, the system looks for authorization in the traditional MPE/iX file access matrix and lockwords.

  • If there is an ACD, the system searches, in this order, for the user:

    1. specific names (username.accountname)

    2. account groupings (@.accountname)

    3. system groupings (@.@)

       If a match is found, the user can access the device or file--as authorized (read, write, execute, and so on)--and no further checking is done.

       If there is no match, the user is denied entry, and no further checking is done.

These MPE/iX commands accept ACD-related parameters or incorporate ACD associations in their operation:

Detailed discussions of these commands are found in the MPE/iX Commands Reference Manual (32650-90003).

The intrinsic FOPEN cannot be modified to give it the option of creating an ACD. You must use HPFOPEN.

Detailed discussions of these intrinsics are found in the MPE/iX Intrinsics Reference Manual (32650-90028).

To assign Read access to user SAM.DOE, Write access to JOE.DOE, no access (None) to all users in the DESIGN account, and Execute access to all users in all accounts (except those users in the DESIGN account, enter this:

   ALTSEC FILEA.XX.DESIGN;NEWACD=(R:SAM.DOE;W:JOE.DOE;NONE:@.DESIGN;X:@.@)

To add an ACD that prevents any user except OPERATOR.SYS from accessing LDEV 7 (a tape drive), enter this:

   ALTSEC 7,LDEV;NEWACD=(R,W:OPERATOR.SYS)

The user must have SM capability to do this.

This short program uses HPACDPUT in creating an ACD for a file called TARGET:

   program acdput(input, output);



   var

     status    : integer;

     filename  : packed array [1..28] of char;

     ACD       : packed array [1..256] of char;



   procedure HPACDPUT;intrinsic;



   begin

   filename := 'TARGET';

   ACD      := '(x:@.@;r,w:mgr.sys)'

   ACD[20] := #m;

   HPACDPUT(status, 1, filename, 20, ACD)

   if status <> 0 then

      writeln('HPACDPUT failed.  Status = ', status);

   end.

When you create a new file with the COPY, FCOPY, STORE, or RESTORE commands, you can use the command parameters to create the ACDs for the new file.

The LISTFILE command with option 4 shows the ACD status of a file in this fashion:

   LISTFILE FILEA,4

   ****************************

   FILEA.XX.DESIGN



   SYSTEM    READ:     ANY

   SECURITY--WRITE:    AC

    (ACCT)   APPEND:   AC

             LOCK:     AC

             EXECUTE:  ANY



   SYSTEM    READ:     GU 

   SECURITY--WRITE:    GU

    (GROUP)  APPEND:   GU

             LOCK:     GU

             EXECUTE:  GU 



   SYSTEM    READ:     ANY          FCODE: 0

   SECURITY--WRITE:    ANY          CREATOR: **

    (FILE)   APPEND:   ANY          LOCKWORD: **

             LOCK:     ANY        **SECURITY IS ON

             EXECUTE:  ANY        **ACD EXISTS



   FOR XX.DESIGN: NONE

(Other ACD status reports are NO ACD and ACD CORRUPTED.)

The LISTFILE command with option -2 gives a detailed ACD report on a file in this fashion:

   LISTFILE FILEA,-2



   FILE = FILEA      ************** ACD ENTRIES **************



                     SAM.DOE            : R

                     JOE.DOE            : W

                     @.DESIGN           : NONE

                     @.@                : X

The SHOWDEV command displays the ACD attributes of a device in this fashion:

   SHOWDEV 14;ACD

   LDEV  AVAIL      OWNERSHIP      VOLID       DEN   ASSOCIATION



    14   SPOOLED      SPOOLER OUT

         ACD ENTRIES: @.@ : R,W,X

This short program uses HPACDINDFO to retrieve the number of entries and first user in the ACD of a file called TARGET:

   program acdinfo(input, output);



   type

     shortint = -32768..32767;



   var

     status      : integer;

     filename    : packed array [1..28] of char;

     numentry    : shortint;

     firstuser   : packed array [1..18] of char;



   procedure HPACDINFO;intrinsic;



   begin

   filename := 'TARGET';

   HPACDINFO(status, 1, filename, 21, numentry, firstuser);

   if status = 0 then

     begin

     writeln('Number of Entires:  ', numentry:1);

     writeln('First UserSpec   :  ', firstuser);

     end;

   end.

To copy the ACD associated with FILEB to FILEA, enter this:

   ALTSEC FILEA.XX.DESIGN;COPYACD=FILEB.XX.DESIGN

Only an owner, or a user granted RACD (read ACD) authorization, can copy the ACD from FILEB.

To copy the ACD attributes of LDEV 7 to LDEV 23, enter this:

   ALTSEC 23,LDEV;COPYACD=7,LDEV

Only users with SM capability may do this. By definition, users having SM capability are owners of all the files and devices on a system. Those users may give themselves access to any file or device on the system.

To confer Read access on JOE.DESIGN for FILEA, enter this:

   ALTSECT FILEA.XX.DESIGN;ADDPAIR=(R:JOE.DESIGN)

To change the (previous) Read access for SAM.DOE to Write access enter this:

   ALTSECT FILEA.XX.DESIGN;REPPAIR(W:SAM.DOE)

To assign Read and Write access to SAM.DOE, do this:

   ALTSEC FILEA.XX.DESIGN;REPPAIR(W,R:SAM.DOE)

To remove @.DESIGN from the ACD attributes of FILEA, enter this:

   ALTSEC FILEA.XX.DESIGN;DELPAIR(NONE:@.DESIGN)

To deny OPERATOR.SYS any access to LDEV 7, enter this:

   ALTSEC 7,LDEV;DELPAIR=(R,W:OPERATOR.SYS)

Only an owner can delete an ACD associated with a file. Only the system manager can delete an ACD associated with a device..

Device ACDs should not be migrated, because they are tied to their system's configuration.

You can move file ACDs between MPE V/E and MPE/iX by using the STORE and RESTORE commands, where COPYACD is the default.

These are the steps CM RESTORE takes during forward migration:

These are the steps CM STORE takes during backward migration:

Be aware that MPE/iX allows more user-mode pairs than MPE V/E does.

You must have authorization to use the ;COPYACD parameter of the STORE and RESTORE commands. If you are not an owner of the file or do not have RACD permission, you get an error. The STORE command checks the ACD on disk for permission. RESTORE checks the ACD from the tape.

For more details, refer to the MPE/iX Commands Reference Manual (32650-90003) and the MPE/iX Intrinsics Reference Manual (32650-90028).

Table 13-1 SYSGEN System Logging

This log gives you an audit trail of changes to the logging configuration. This log is initially enabled (ON). The following is the log record format:

This log traces file restorations. Files can be restored from tape or serial disk to the system. This log type is initially disabled (OFF). It can be enabled by SYSGEN followed by a START command. The following is the log record format:

This log keeps track of failed attempts attaching spool files to printers. New spool files, which are logged by FOPEN as event #144, are not logged here.

This log is initially disabled, but can be enabled by SYSGEN followed by a START command.

This log records the name of a streamed job, its number, the user that initiates it (and the logon), and the scheduled date and time.

This log is initially disabled, but can be enabled by SYSGEN followed by a START command.

This log keeps a record of all OPENLOG and CLOSELOG intrinsic calls. The system manager can use it to see who accesses, or tries to access, the user logging facility.

This log is initially disabled, but can be enabled by SYSGEN followed by a START command.

The LOG ID field in the log record is "XXXXXX" for CLOSELOG intrinsic when the index is bad.

You can use this log to record all process creations. This log is initially disabled, but can be enabled by SYSGEN followed by a START command.

*The capabilities mask is read as follows:

        User              File access          Program/group

   bit    capability    bit   capability      bit   capability

    0        SM          6       CV            23      BA

    1        AM          7       UV            24      IA

    2        AL          8       LG            25      PM

    3        GL          9       SP            28      MR

    4        DI         10       PS            30      DS

    5        OP         11       NA            31      PH

                        12       NM

                        13       CS

                        14       ND

                        15       SF

• 102, job initiation

• 103, job termination

• 104, process termination

• 105, file close (also 160)

• 108, spooling log

• 112, physical mount/dismount

• 113, logical mount/dismount

• 114, tape labels

• 115, console log

• 116, program file event

• 120, new commercial spooling

• 130, architecture interface

• 134, password change

• 135, system logging configuration

• 136, restore

• 137, printer access failure

• 138, ACD changes

• 139, stream initiation

• 140, user logging access

• 141, process initiation

• 143, change group

• 144, file open

• password changes (event type 134)

• printer access failure (event type 137)

• ACD changes (event type 138)

System logging records when a user, group, or account password is changed by an MPE/iX command or a utility program. This log is initially disabled (OFF).

The information recorded in this logging includes

In this example, JOHN.PAYROLL,DOE, job or session name JREPORT, successfully changed the account password for PAYROLL through the command excutor. The change was made from LDEV 21.

The LOGTOOL utility formats the following layout after the standard header:

   TARGET USER:                         TARGET GROUP:

   TARGET ACCOUNT:     PAYROLL          TYPE CHANGED:     ACCOUNT

   LDEV:               21

   EXECUTED FROM:      CI.PUB.SYS

   USER:               JOHN             GROUP:            DOE

   ACCOUNT:            PAYROLL          JSNAME:           JREPORT

The following is the log record format:

	NOTE: The PASSWORD command, allows all users to change their own passwords. In the past, only system managers and account managers could change any passwords.

This log type is activated when ACDs are changed (created, deleted, copied, or modified) with MPE/iX commands or intrinsics. The log is initially disabled (OFF).

The information recorded in this logging includes

In this example, user JOHN.PAYROLL,DOE, with job or session name JREPORT, successfully created an ACD for a file called FTEST.TESTGP.PAYROLL, using the command executor.

The LOGTOOL formats the following layout after the standard header:

   TARGET OBJECT:        FTEST.TESTGP.PAYROLL

   SOURCE OBJECT:

   FUNCTION:             CREATE

   EXECUTED FROM:        CI.PUB.SYS

   STATUS                SUCCESSFUL

   USER                  JOHN              GROUP:         DOE

   ACCOUNT:              PAYROLL           JSNAME:        JREPORT

The following is the log record format: