🚀 go-pugleaf

In article <C1Go77.LIx@micrognosis.co.uk>, nreadwin@micrognosis.co.uk (Neil Readwin) writes...
>In article <4630@mitech.com>, gjc@mitech.com (George J. Carrette) writes:
>|> Is it possible to prevent a user from being able to
>|> change the protection on a directory that he owns?
> 
>No. If you look at the Guide to VMS System Security you will find (Figure
>4-4) a flowchart. Even if an ACL explicitly denies access then it will
>branch off to BB (UIC based checks). If the requester UIC is the owner UIC
>then it checks the protection code for the object. If you read between the
>lines of section 4.2.3 then it is clear that UIC based protection always
>grants CONTROL access to the owner.
>-- 
> Phone: +44 71 815 5283  E-mail: nreadwin@micrognosis.co.uk
> Anything is a cause for sorrow that my mind or body has made

Yep.  IN addition, you should know that the capability that you want does
exist, but not in VMS.  VMS has a "big brother" called Secure VMS (SEVMS)
which can do this.  It is a so-called "trusted system", which implements a
thing called mandatory controls.  The security in a mandatory control
environment is imposed on the user by the system - they can't change it. 
This is opposed ot what we have in version vanilla VMS called descretionary
controls.  If you want more information on SEVMS - contact me or your local
DEC sales person.  More information on trused systems:

	See my column in Digital News and Review the last two issues

	Books that give the subject a nice treatment:

	Computer Security Basics
	Deborah Russell and G.T> Gangemi Sr.
	ISBN 0-937175-71-4
	Oreilly and Associates, 1991
	(800) 338-6887


	Dave Curry's UNIX System Security - A guide for users 
		and system administrators
	ISBN 0-201-56327-4
	Addison Wesley - 1992

A note of caution- the trusted systems arena is in flux.  The U.S. Govt is
issuing a new "criteria" for these systems to bring their ideas on this
more into line with those of other countries of the world.  At the moment,
each country has its own ideas about this trusted system stuff and - as you
might guess - the Americans are more "military" oriented while the rest of
the world is more concerned with the privacy and availability issues of
commercial industry.  Consider some of the security news groups as places
to hang out:  alt.security - comp.security....

Ray Kaplan
P.O. Box 42650
Tucson, AZ  85733
kaplan@bpa.arizona.edu

RayK 8)