Accessing Files Programmer's Guide (32650-90885)

184 Chapter13
Maintaining File Security
Traditional Mechanism for File Security
• account member (AC)
If no security provisions are explicitly specified, the following provisions apply by default:
• For a public group (named PUB), whose files are normally accessible in some way to all
users within the account, reading and executing access are permitted to all users;
appending, writing, saving, and locking access are limited to account librarian users
and group users (including group librarian users). (R, X: ANY; A, W, L, S: AL, GU).
• For all other groups in the account, reading, appending, writing, saving, locking, and
executing access are limited to group users. (R, A, W, L, X, S: GU).
File-level security
When a file is created, the security provisions that apply to it are the default provisions
assigned by MPE/iX at the file level, coupled with the user-specified or default provisions
assigned to the account and group to which the file belongs. At any time, however, the
creator of the file (and only this individual) can change the file-level security provisions, as
described in the following pages; thus, the total security provisions for any file depend
upon specifications made at all three levels, the account, group, and file levels. A user must
pass tests at all three levels–account, group, and file security, in that order–to successfully
access a file in the requested mode.
If no security provisions are explicitly specified by the user, the following provisions are
assigned at the file level by default:
• For all files, reading, appending, writing, locking, and executing access are permitted to
all users. (R, A, W, L, X: ANY).
Because the total security for a file always depends on security at all three levels, a file not
explicitly protected from a certain access mode at the file level may benefit from the
default protection at the group level. For example, the default provisions at the file level
allow the file to be read by any user–but the default provisions at the group level allow
access only to group users; thus, the file can be read only by a group user.
In summary, the default security provisions at the account, group, and file levels combine
to result in overall default security provisions as listed in Table 13-13. on page 185 Stated
another way, when the default security provisions are in force at all levels, the standard
user (without any other user attributes) has:
• unlimited access (in all modes) to all files in his logon group and home group
• reading and executing access (only) to all files in the public group of his account and the
public group of the system account
The important file security rules may be defined as follows:
• Users can create files in their own accounts.
• Only the creator can modify a file's security.
• If a lockword is present on a file, then it is required in order to access the file.
• Account managers have unlimited access to the files within their accounts.
• System managers have unlimited access to any file, but can save files only in their