Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Disk-File Security Commands
Safeguard Reference Manual — 520618-030
8 - 15
ADD DISKFILE-PATTERN Command
Only a local super ID can add an authorization record for a licensed program
object file and retain the license attribute in the newly added authorization record.
Examples
•
The owner of the disk file $DATA.KEEP.INFO uses these commands to add a
Safeguard authorization record for the file, provide its description, and give
ownership of the file to a member of group 86:
=SET DISKFILE ACCESS 86,2 (r,w,e,p); 86,* (r,e)
=SET DISKFILE CLEARONPURGE ON, AUDIT-ACCESS-PASS all,&
=AUDIT-MANAGE-PASS all
=ADD DISKFILE $DATA.KEEP.INFO,OBJECT-TEXT-DESCRIPTION “ACL &
and Record Created”,OWNER 86,2
The first SET command establishes an ACL that grants all four access privileges
(RWEP) to user ID 86,2 and allows every member of the group 86 to read and
execute the file. Next, the CLEARONPURGE attribute is set to ON, and the
Safeguard software is instructed to audit all successful attempts to access this file
or its authorization record. Finally, the ADD command adds a Safeguard record,
allows you to add information on the object, and sets the OWNER attribute to user
ID 86,2.
•
Following example creates a process from a diskfile and grants create permissions
to a specific user or group.
add diskfile $data.vol.test, process-access x.y C
A process is created from object test such that create permission is granted to the
user x.y.
ADD DISKFILE-PATTERN Command
ADD DISKFILE-PATTERN creates a Safeguard authorization record for one or more
disk files. After a diskfile-pattern authorization record is created, all attempts to access
the disk files described by that pattern are subject to a Safeguard authorization check
and optionally to Safeguard auditing.
You can use SET DISKFILE-PATTERN to establish default disk-file attribute values
and then use ADD DISKFILE-PATTERN simply to name the disk files to which the
default attributes are to be applied. You can also specify values for the disk-file
Caution. When adding an authorization record for a licensed program object file, set the
LICENSE attribute value to ON. If the LICENSE attribute is OFF (the default value), the
license for that object file is revoked.
When you add an authorization record for a disk file th
at currently has the PROGID or
CLEARONPURGE options set to ON, set the corresponding disk file attribute to ON before
adding the authorization record. (The default attribute value for PROGID and
CLEARONPURGE is OFF.)