Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Security Group Commands
Safeguard Reference Manual — 520618-030
13 - 9
ADD SECURITY-GROUP Command
AUDIT-MANAGE-FAIL [audit-spec]
changes the audit-spec for unsuccessful attempts to manage this
authorization record. The form of audit-spec is:
{ ALL | LOCAL | REMOTE | NONE }
For a description of the audit-specs, see the
SET SECURITY-GROUP
Command on page 13-25. Omitting audit-spec specifies NONE.
For a complete description of the group-attributes, see the SET SECURITY-
GROUP Command on page 13-25.
Considerations
•
Additional owners can modify the authorization record.
In addition to the owner, the primary owner’s group manager, and the local super
ID, any user ID that has an ACL entry granting OWNER authority can also modify
the security group authorization record.
•
Attributes in an ADD command affect only the record added.
Any attribute specifications in an ADD SECURITY-GROUP command affect only
the authorization record being created and do not change the current default group
attribute values. This condition is also true for a LIKE clause in an ADD
SECURITY-GROUP command.
Example
You can use a LIKE sec-group-name clause to copy all attribute values for one
security group from another security group. Then you can specify in the same
command line that one or more attribute values will be different.
This sample command adds an authorization record for the SYSTEM-OPERATOR
security group that has the same group attribute values (and ACL) as the SECURITY-
ADMINISTRATOR security group, except for the OWNER attribute. It also allows you
to add object text description:
=ADD SECURITY-GROUP sys-oper, OBJECT-TEXT-DESCRIPTION “Added a &
record”,LIKE sec-admin, OWNER super.sue
You can define membership in the SECURIT
Y-OSS-ADMINISTRATOR security group
by adding an authorization record for that group. For example, this command creates
the authorization record for the SECURITY-OSS-ADMINISTRATOR security group and
allows you to enter object text description:
=ADD SECURITY-GROUP SECURITY-OSS-ADMINISTRATOR, &
OBJECT-TEXT-DESCRIPTION “Added a record”,&
Note. Specifying ACCESS access-spec with ADD SECURITY-GROUP does not override
the current default ACL (established with SET SECURITY-GROUP). Instead, any ACL entries
specified with ADD SECURITY-GROUP modify the template of current default settings.