Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Disk-File Security Commands
Safeguard Reference Manual — 520618-030
8 - 30
ALTER DISKFILE Command
The following two commands perform similar functions but are not strictly
equivalent:
FUP SECURE filename-list , "security-string"
ALTER DISKFILE filename-list , ACCESS access-spec
[ ; access-spec ] ...
An access-spec can include or deny specific users or groups of users to which
the owner does not belong. A security-string does not have this flexibility.
•
Altering a disk file that is currently open
Using ALTER DISKFILE to change one or more attributes for a disk file has no
effect on any users currently accessing the disk file. (That is, changing file security
attributes has no effect on processes that currently have the disk file open.)
For example, if you change a disk-file ACL to deny Read access to a user who is
running a process that is currently accessing the file, the process can continue
accessing the file until it closes the file. However, when the process attempts to
reopen the file for Read access, the Safeguard software returns a security violation
(file error 48).
Examples
•
The owner of the file $DATA.KEEP.INFO adds three ACL entries, provides their
description, and changes another entry:
=ALTER DISKFILE $data.keep.info,OBJECT-TEXT-DESCRIPTION&
“Record Created”, ACCESS 86,8 (r,w,e) ; &
=86,10 (r,w,e); prs.darlene DENY (w,e,p) ; 86,* - e
Now the users who have user IDs 86,8 and 86,10 can read, write, and execute this
file, and user PRS.DARLENE cannot write, execute, or purge the file. The ACL
entry for group 86 is changed so that members of group 86 no longer have
EXECUTE authority for the file.
•
The super ID uses this command to alter authorization records for all files on the
volume $DATA that have either the PROGID or LICENSE attribute set ON. The
Safeguard authorization records specify auditing for all attempts to access or
manage these files.
=ALTER DISKFILE $data1.*.*, AUDIT ALL &
=WHERE (PROGID OR LICENSE)
•
This example sets WARNING-MODE to OFF in files where WARNING-MODE is
ON in the $data.lawsuit subvolume.
=ALTER DISKFILE $data.lawsuit.*, WARNING-MODE OFF WHERE &
=WARNING-MODE
•
This example creates a process and grants purge permissions to a specific user or
group.
alter diskfile $data.vol.test,process-access x.y p