Storage Management Foundation User's Guide

Preparing to Use SMF
HP NonStop Storage Management Foundation User's Guide—523562-008
2-13
Safeguard Usage
Safeguard Usage
Safeguard security is based on the logical file name. Safeguard checks security for
logically named files by using the virtual volume, rather than by using a physical
volume.
Safeguard Security and Availability
With SMF virtual disk processes, files on a single virtual disk can be placed on more
than one physical disk. However, Safeguard stores all volume level, subvolume level,
and file level access control rules for the virtual disk in a single logical SAFE.GUARD
file. Safeguard denies new access requests for a file if the physical disk containing the
SAFE.GUARD file is unavailable, even if the disk where the requested file resides is
available. However, applications that already have access to the file continue to access
it even if the physical disk where the SAFE.GUARD file resides becomes unavailable,
unless the application requires some new level of access to the file.
Safeguard protection must be enabled on a per-system basis. It cannot be turned off
for a virtual disk when the physical volume where SAFE.GUARD resides becomes
unavailable. For this reason, it is critical that logical SAFE.GUARD files be placed on
mirrored disks to avoid a single hardware point of failure. If necessary, the FUP
RELOCATE command should be used to move the SAFE.GUARD file to a mirrored
disk.
Physical Device Access and Control
Applications and operational procedures that use Safeguard security to restrict user
access to particular physical volumes do not perform as expected for logically named
files. Safeguard does not check physical volume security access control information
when creating, accessing, purging, or renaming logically named files. For example, a
user can create a logically named file that happens to reside on a physical disk where
that user does not have create authority, because Safeguard applies the physical disk
volume’s create authority only for direct files. In installations where Safeguard security
is used as a resource control to prevent the placing of files on disks, pay close
attention to storage pool and virtual disk configurations to ensure that operational goals
are met.
Optical Disk Usage
Optical disks are not permitted in SMF storage pools, which means that logically
named files cannot reside on an optical disk.
Note. Moving the SAFE.GUARD file requires that the entire Safeguard subsystem be shut
down.