OSF DCE Administration Guide--Core Components

DCE Application Administration

This section shows how to manage ACLs that protect server control information. For

detailed information about setting and using ACL protections, see Chapter 28.

10.1.1.3.1 Permissions for the Server Conﬁguration Container

The server conﬁguration information resides in a container. The container, a backing

storage mechanism implemented as a ﬁle on UNIX systems, is owned by root and is also

protected by an ACL. These ACL permissions control who can access information in the

container. Each DCE host has one server conﬁguration Container ACL with the

following name:

/.../cellname/hosts/hostname/conﬁg/srvrconf

The server conﬁguration Container ACL has the following permissions:

c (control) Modify the Container ACL

r (read) Read conﬁguration information in the container

i (insert) Create new conﬁguration information

I (Insert) Create new conﬁguration information for a server that runs as a

privileged user (for example, as root on a POSIX system). Such

operations also require the i permission.

Use the dcecp acl object to view or modify ACLs. For example, use the following

operation to view the ACL for the server conﬁguration container object on host silver:

dcecp> acl show /.:/hosts/silver/conﬁg/srvrconf

{user appl_admin criI}

{unauthenticated r}

{any_other r}

Because /.:/hosts/silver/conﬁg/srvrconf is a container, it also has an Initial Container

ACL and an Initial Object ACL. You can operate on these initial ACLs by using the -ic

and -io options to acl operations. Note, however, that because you cannot currently

create child containers under /.:/hosts/hostname/conﬁg/srvrconf, the Initial Container

ACL has no effect.

10.1.1.3.2 Permissions for Accessing Server Conﬁguration Information

Each server’s conﬁguration information is protected by its own ACL. These ACLs can

prevent unauthorized principals from creating, reading, changing, or deleting server

conﬁguration information, and from starting, stopping, enabling, and disabling servers.

Each ACL is named for the server conﬁguration information it protects and has a name

like the following:

/.../cellname/hosts/hostname/conﬁg/srvrconf/server_name

124243 Tandem Computers Incorporated 10−5