Accessing Files Programmer's Guide (32650-90885)

182 Chapter13
Maintaining File Security
Traditional Mechanism for File Security
Users with system manager or account manager capability bypass the standard security
mechanism. A system manager has unlimited file access to any file in the system
(R,A,W,L,X:ANY), but can save files only in his own account (S:AC); an account manager
user has unlimited access to any file within the account (R,A,W,L,X,S:ANY). One exception
is that in order to access a file with a negative file code (a privileged file), the account
manager must also have the privileged mode (PM) capability.
The user-type categories that a user satisfies depend on the file he is trying to access. For
example, a user accessing a file that is not in his home group is not considered a group
librarian for this access even if he has the group librarian user attribute.
NOTE In addition to the above restrictions in force at the account, group, and file
level, a file lockword can be specified for each file. Users then must specify the
lockword as part of the file name to access the file.
The security provisions for the account and group levels are managed only by users with
the system manager and the account manager capabilities respectively, and can only be
changed by those individuals.
Account-level security
The security provisions that broadly apply to all files within an account are set by a system
manager user when creating the account. The initial provisions can be changed at any
time, but only by that user.
At the account level, five access modes are recognized:
• reading (R)
• appending (A)
• writing (W)
• locking (L)
• executing (X)
Also at the account level, two user types are recognized:
Group
Librarian User
GL User with Group Librarian capability, who can manage
certain files within his home group.
Creating User CR The user who created this file.
Group User GU Any user allowed to access this group as his logon or home
group, including all GL users applicable to this group.
Account
Member
AC Any user authorized access to the system under this account;
this includes all AL, GU, GL, and CR users under this
account.
Table 13-12. User Type Definitions (Traditional Security)
USER TYPE MNEMONIC
CODE
MEANING