Safeguard Administrator's Manual (G06.29+, H06.08+, J06.03+)

Controlling User Access

Safeguard Administrator’s Manual—523317-029

2-36

Establishing Default Ownership

You can specify two types of ownership with DEFAULT-PROTECTION. You specify

one with the OWNER attribute of the user record, and you specify the other with

OWNER authority in an access control list. Both types of owners can modify the disk

file authorization record after it is created. However, only the primary owner, secondary

owners, or a super ID can set the PROGID attribute to protect program code. Also, if

the disk file is removed from the Safeguard database, the primary owner becomes the

Guardian owner.

If no primary owner is specified, as in the previous example, the primary owner is the

user for which DEFAULT-PROTECTION is being specified: in this case, ADMIN.JEFF.

However, if SECURITY.SUSAN needs to be the primary owner of all new files that

ADMIN.JEFF creates, she can specify her user ID for the OWNER attribute. For

example:

=ALTER USER 1,12, DEFAULT-PROTECTION OWNER 200,1

SECURITY.SUSAN displays the authentication record for ADMIN.JEFF to verify that

she is the default owner of any files he creates:

=INFO USER 1,12, DEFAULT-PROTECTION

The display shows:

Specifying Default Audit Attributes

DEFAULT PROTECTION also includes these four audit attributes for disk files:

•

AUDIT-ACCESS-PASS

•

AUDIT-ACCESS-FAIL

•

AUDIT-MANAGE-PASS

•

AUDIT-MANAGE-FAIL

These audit attributes are explained in detail in the Safeguard Audit Service Manual.

GROUP.USER USER-ID OWNER LAST-MODIFIED LAST-LOGON STATUS WARNING-MODE

ADMIN.JEFF 1,12 200,1 15AUG05, 9:05 12AUG05, 16:02 THAWED OFF

SUBJECT DEFAULT-PROTECTION SECTION

OWNER= 200,1

AUDIT-ACCESS-PASS = NONE AUDIT-MANAGE-PASS = NONE

AUDIT-ACCESS-FAIL = NONE AUDIT-MANAGE-FAIL = NONE

001,012 R,W,E,P, O

001, * R, E