Safeguard Administrator's Manual (G06.24+, H06.03+)

Safeguard Administrator’s Manual—523317-013
6-1
6 Managing Security Groups
The Safeguard subsystem allows you to define three special security groups to control
the use of certain restricted commands. The two groups—named
SECURITY-ADMINISTRATOR and SYSTEM-OPERATOR—designate who can use
the audit service commands, the third group—named SECURITY-OSS-
ADMINISTRATOR—designate a list of users who are granted additional OSS security
management privileges over the normal users for the operations, acl(ACL_SET),
chown(2), chmod(2), chdir(2), and opendir(3),TERMINAL commands, EVENT-EXIT-
PROCESS commands, ALTER SAFEGUARD command, and STOP SAFEGUARD
command. The security groups do not exist until you add them to the Safeguard
database.
Use the ADD SECURITY-GROUP and ALTER SECURITY-GROUP commands to
define membership in the security groups. Table 6-1 lists these groups and the
functions allowed to their members. For a complete description of the commands used
to manage the security groups, see the Safeguard Reference Manual.
Note. In prior product versions, the Safeguard security groups were managed by GROUP
commands. GROUP commands are now used to manage file-sharing groups, as described in
Section 3, Managing User Groups
. Security groups are now managed with the SECURITY-
GROUP commands, as described in this section.
Note. The SECURITY-OSS-ADMINISTRATOR security group is supported only on systems
running G06.29 and later G-series RVUs and H06.08 and later H-series RVUs.
Table 6-1. Security Groups and Restricted Commands (page1of2)
Command
SECURITY-
ADMINISTRATOR
SYSTEM-
OPERATOR
ADD AUDIT POOL Yes Yes
ALTER AUDIT POOL Yes Yes
ALTER AUDIT SERVICE Yes No
DELETE AUDIT POOL Yes Yes
NEXTFILE No Yes
RELEASE No Yes
SELECT Yes Yes
ADD TERMINAL Yes No
ALTER TERMINAL Yes No
DELETE TERMINAL Yes No
FREEZE TERMINAL Yes Yes
THAW TERMINAL Yes Yes