NonStop SQL/MP Reference Manual

NonStop SQL/MP Reference Manual—142115
S-13
Process Access IDs
group 255 and user number 255. Normally (by convention), both group 255 and user
255 in group 255 are named SUPER; for example:
The super ID can act as the owner of any object or file on the node. Certain operations
can be performed only by a user logged on with the super ID.
Process Access IDs
Each executing process on a Tandem NonStop system has a process access ID (PAID)
that determines the NonStop SQL/MP objects and Guardian files the process can access.
The process access ID is always a Guardian user ID.
If you work through TACL, the executing TACL process has a process access ID that is
the Guardian user ID you supplied at logon. If you work through an OSS shell, the
executing shell process has a process access ID that is the Guardian user ID you
supplied at logon.
After logon, each process you start normally inherits the processor access ID of the
process that starts it—so processes you start from the TACL process, such as SQLCI or
host language programs (and any processes you start from those processes), normally
inherit the processor access ID that is also the Guardian user ID you supplied at logon.
In this way, your initial logon usually determines the NonStop SQL/MP objects and
Guardian files that you can access.
A process does not inherit the processor access ID of the process that starts it if you
execute a program that has the PROGID file attribute set. The PROGID attribute of a
program file specifies that a process started from that program file should use the
Guardian user ID of the owner of the program file as its process access ID, not the
process access ID of the user who starts the process. When this occurs, the Guardian
user ID of the owner of the program file determines the NonStop SQL/MP objects and
Guardian files that the program can access, regardless of the user that executes the
program.
The process access ID of the process you are executing (in conjunction with the security
string described in the next subsection) determines the objects and files you can access
with that process. Therefore, if the SQL documentation says that in order to perform a
certain operation
"you must have authority to ..."
it means that the process access ID of the process you execute must have the authority.
The owner of an SQL program in a Guardian file can use the ALTER PROGRAM
statement or the SECURE command to set the PROGID attribute of the program file. If
a program is secured with the Safeguard subsystem, the owner can use the Safeguard
subsystem to set the PROGID attribute. NonStop SQL/MP stores the PROGID attribute
of an SQL program in the PROGRAMS table of the catalog in which the program is
registered and in the file label of the program itself.
255,255 <-- Super ID number
SUPER.SUPER <-- Typical super ID name