Safeguard User's Guide (G06.29+, H06.08+, J06.03+)

Safeguard User’s Guide — 422089-020
9 - 1
9 Working with Patterns
Background
The NonStop operating system groups files into subvolumes and volumes. Safeguard
provides three levels of access control to files using the volume, subvolume, and file
name. If all the files in a subvolume can have the same access requirements, then one
subvolume protection record will meet the requirements for many files. Similarly one
volume protection record would suffice if all the files and subvolumes on a single
volume have the same access requirements. However, as the size of disks increase,
the less likely a single volume protection record would suffice. As a result, the number
of protection records tends to increase as the capacity of disk drives increase, and the
potential number of disk files increases.
A common practice is to use a naming convention for volumes, subvolumes and file
names to distinguish domains (application A versus application B), roles (production
versus test versus support) and contents (such as hourly or daily log files and queues
versus databases versus control files versus support files.)
A naming convention introduces a discernible pattern of characters into the name of a
volume, subvolume, or file. As the number of volumes, subvolumes, and file names
that require distinct access controls increase, so does the administrative burden
required to create and manage the corresponding access control lists.
Patterns reduce administrative burden by allowing one pattern to match many
subvolumes or filenames. That is, a pattern will be a template that represents a fully
qualified file name. Thus there is no concept of the three levels of searching done with
normal protection records: volume, subvolume, and filename.
Searching can involve scanning many patterns, and may result in more than one
match. Thus we categorize patterns as to their degree of generality.
Introduction
What is a Pattern?
In the G06.25 release of patterns, a pattern must contain at least one wildcard in either
or both the subvolume or filename. A pattern cannot contain a wildcard in the volume
name.
Since patterns contain wildcards as part of their name, they do not represent a specific
file. Patterns are metadata. When a wildcard is encountered in a pattern, the intent of
the command has to be distinguished between using that wildcard as part of the
pattern and using the wildcard as a search character.