Guardian Programmer's Guide

Coordinating Concurrent File Access
Guardian Programmer’s Guide — 421922-014
3 - 3
Setting the Exclusion Mode
Refer to the TACL Reference Manual for more details on the TACL FILEINFO
command.
Consider a file owned by user 24,48 (where 24 is the user’s group number and 48 is
the user number within that group) with security permissions “GOA-”:
A process executed by user 24,40 now tries to open the file. If this process tries to
open the file for reading and writing, the open will fail because the file security permits
only the owner to write to the file. Similarly, the open will fail if user 24,40 tries to open
the file in write-only mode. If user 24,40 tries to open for reading only, however, the
open will succeed because the owner and the opener are in the same group and the
owner has set the security on the file to allow anyone in the same group to read the
file.
For details on how to set and change the security of a file using the TACL program,
refer to the Guardian User’s Guide.
Setting the Exclusion Mode
To ensure a consistent view of data, it is often necessary to restrict concurrent access
to a file. The file system provides the following levels of exclusion:
•
Shared (the default exclusion)
The opening process tolerates any access mode of other openers, but no other
process is allowed exclusive access to the file. Shared mode also prevents
another process from opening the file with the protected mode if this process has
the file open for writing.
Shared mode permits the highest level of concurrent operation and is therefore the
normal mode of operation in a multiple-user environment where there is access to
G In the read column indicates that anyone in the user’s group on the local node
can read the file, but no one outside the group can read it.
O In the write column says only the owner on the local node can open the file for
writing.
A In the execute column says anyone on the local node can execute the file.
– In the purge column says only the super-ID user on the local node can purge the
file.
Note. If files are protected by Safeguard, then the FILEINFO command does not return useful
information. If the Safeguard protection is applied at the file level, then FILEINFO returns a
string of asterisks for the security permissions for that file. If the Safeguard protection is
applied at the subvolume or volume level, then the output of the FILEINFO command appears
as a normal FILEINFO display but does not reflect the Safeguard protection.
The Safeguard protection mechanism is different from the mechanism described here. See
th
e Safeguard Reference Manual for details.