Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Disk-File Security Commands
Safeguard Reference Manual — 520618-030
8 - 13
ADD DISKFILE Command
A process originated from a program file calling USER_AUTHENTICATE_ with
a 2 and 15 bit set to ON, the requesting user for authentication need not give a
password. Even with wrong password the user will be able to logon
successfully as bit 2 and 15 in the options field. In case of only bit 2 set to 1
and bit 15 as 0; no fail delay will take place. That is, no failure delay will be
imposed even after three attempts with wrong password. The authentication
will not be successful but there will be no delay imposed.
Also establishes whether the program file (object disk file) can request a delay
to be imposed for failed logon attempts. When set to ON, a process created
from this program file is not subjected to logon failure delays.
OFF is the initial value.
PRIV-LOGON may also be used in the WHERE expression of a command to
restrict scope of that command to files with PRIV-LOGON ON.
Considerations
•
Attributes in an ADD command affect only the record added.
Any attribute specifications in an ADD DISKFILE command affect only the
authorization record being created and do not change the current default disk-file
attribute values. This condition is also true for a LIKE clause in an ADD DISKFILE
command.
•
Disk-file security can be managed from a remote node.
An authorization record for a disk file can be added by only the local owner of the
file, the owner’s group manager, or the super ID. However, if a disk-file
authorization record is added that specifies a network user ID for the OWNER
attribute, the authorization record can be altered, frozen, thawed, and deleted by
that network user from a remote or local node.
•
Relationship between ADD DISKFILE and the FUP GIVE, SECURE, LICENSE,
and REVOKE commands
After you create an authorization record for a
disk file, the FUP GIVE, SECURE,
LICENSE, and REVOKE commands no longer work for the disk file. You must use
the ALTER DISKFILE command to perform the equivalent operations. (For a list of
equivalent FUP and SAFECOM commands, see the Considerations for ALTER
DISKFILE Command on page 8-21.)
However, the super ID can use the FUP SECURE, LICENSE, and REVOKE
commands on a disk file that has a Safeguard protection record. Even though this
usage is allowed, restrict it to emergency situations. It can result in access
mediation problems and inconsistencies in Safeguard protection records.
•
Using LIKE disk-file-name