Thread View: vmsnet.sysmgt
3 messages
3 total messages
Started by George J. Carrette
Fri, 22 Jan 1993 18:43
Here is a ACL question for you!
Author: George J. Carrette
Date: Fri, 22 Jan 1993 18:43
Date: Fri, 22 Jan 1993 18:43
22 lines
1134 bytes
1134 bytes
Is it possible to prevent a user from being able to change the protection on a directory that he owns? E.G. We have USER$DISK:[000000]USER1.DIR with S:RWE,O:RWE,G:RE,W:RE And what I want to -prevent- the user from changing his directory to say W:RWE which he might do to allow other users to copy files into his directory for him. We want to prevent that because we don't want users to come running to us when they suddenly have files in their directory that the cannot delete. One partial solution is: $ SET ACL/ACL=(IDENT=*,ACCESS=READ+EXECUTE) USER$DISK:[000000]USER1.DIR It doesnt prevent the user from changing the UIC protection of his directory, but it does prevent IDENT=* from being able to WRITE into the directory anyway. Until the USER1 in question figures out how to SET ACL himself. By which time he should know better.
Re: Here is a ACL question for you!
Author: Neil Readwin
Date: Tue, 26 Jan 1993 12:33
Date: Tue, 26 Jan 1993 12:33
13 lines
1111 bytes
1111 bytes
In article <4630@mitech.com>, gjc@mitech.com (George J. Carrette) writes: |> Is it possible to prevent a user from being able to |> change the protection on a directory that he owns? No. If you look at the Guide to VMS System Security you will find (Figure 4-4) a flowchart. Even if an ACL explicitly denies access then it will branch off to BB (UIC based checks). If the requester UIC is the owner UIC then it checks the protection code for the object. If you read between the lines of section 4.2.3 then it is clear that UIC based protection always grants CONTROL access to the owner. -- Phone: +44 71 815 5283 E-mail: nreadwin@micrognosis.co.uk Anything is a cause for sorrow that my mind or body has made
Re: Here is a ACL question for you!
Author: Steve... friends don't let frien...
Date: Tue, 26 Jan 1993 19:18
Date: Tue, 26 Jan 1993 19:18
55 lines
3103 bytes
3103 bytes
In article <C1Go77.LIx@micrognosis.co.uk>, nreadwin@micrognosis.co.uk (Neil Readwin) writes... >In article <4630@mitech.com>, gjc@mitech.com (George J. Carrette) writes: >|> Is it possible to prevent a user from being able to >|> change the protection on a directory that he owns? > >No. If you look at the Guide to VMS System Security you will find (Figure >4-4) a flowchart. Even if an ACL explicitly denies access then it will >branch off to BB (UIC based checks). If the requester UIC is the owner UIC >then it checks the protection code for the object. If you read between the >lines of section 4.2.3 then it is clear that UIC based protection always >grants CONTROL access to the owner. >-- > Phone: +44 71 815 5283 E-mail: nreadwin@micrognosis.co.uk > Anything is a cause for sorrow that my mind or body has made Yep. IN addition, you should know that the capability that you want does exist, but not in VMS. VMS has a "big brother" called Secure VMS (SEVMS) which can do this. It is a so-called "trusted system", which implements a thing called mandatory controls. The security in a mandatory control environment is imposed on the user by the system - they can't change it. This is opposed ot what we have in version vanilla VMS called descretionary controls. If you want more information on SEVMS - contact me or your local DEC sales person. More information on trused systems: See my column in Digital News and Review the last two issues Books that give the subject a nice treatment: Computer Security Basics Deborah Russell and G.T> Gangemi Sr. ISBN 0-937175-71-4 Oreilly and Associates, 1991 (800) 338-6887 Dave Curry's UNIX System Security - A guide for users and system administrators ISBN 0-201-56327-4 Addison Wesley - 1992 A note of caution- the trusted systems arena is in flux. The U.S. Govt is issuing a new "criteria" for these systems to bring their ideas on this more into line with those of other countries of the world. At the moment, each country has its own ideas about this trusted system stuff and - as you might guess - the Americans are more "military" oriented while the rest of the world is more concerned with the privacy and availability issues of commercial industry. Consider some of the security news groups as places to hang out: alt.security - comp.security.... Ray Kaplan P.O. Box 42650 Tucson, AZ 85733 kaplan@bpa.arizona.edu RayK 8)
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads