Guardian User's Guide

Managing Users and Security
Guardian User’s Guide—425266-001
16-16
Adopting the Owner ID of a Program File
ALTERPRIORITY, SUSPEND, STOP, and DEBUG are examples of security-restricted
operations. If you need to perform security-restricted operations and do not have the
appropriate process-access permissions, see your system administrator, security
administrator, or group manager for assistance. For more information about security-
restricted operations, see the Guardian Procedure Calls Reference Manual.
When a process is created, the operating system passes the appropriate process access
ID to the descendant process. This ID becomes the creator access ID of the new process.
The process access ID of the new process can come from either of two sources: the
process access ID of its creator (this is the usual case), or the owner ID of the program
file (if file adoption was specified with the FUP SECURE PROGID attribute).
Adopting the Owner ID of a Program File
Program file owner ID adoption allows the owner of a program file (or the super ID) to
specify that the process access ID of any process created by running that program file is
to be the same as the owner ID of the program file rather than the process access ID of
the creating process. This option allows the owner of the program file to control the files
that the new process can access and to control the operations that can be performed on
or by the process. Program file ID adoption is specified with the FUP SECURE
command (PROGID option) or the SETMODE or SETMODENOWAIT procedure.
Figure 16-2
shows several generations of processes and demonstrates how creator access
and process access IDs can change when the PROGID attribute is set on. CI is a
command interpreter process with process access ID 8,10. P1 is a process created by CI,
and p2 is a process created by p1.
Figure 16-1. Passing of Access IDs
012CDT .CDD
Creator Access ID = 8,10
Process Access ID = 8,10
(p2)
Process Access ID =
8,10
(CI)
Creator Access ID = 8,10
Process Access ID = 8,10
(p3)
(p1) Creator Access ID = 8,10
Process Access ID = 8,10