protection at the group lev el. For detailed information on this topic, refer to Accessing Files Programmer's Guide (32650-90017).

Access Control Definitions (ACDs)

Access Control De￿nitions (A CDs) allow the owner of a ￿le to specify permissions for access to a ￿le or to a device. An A CD takes precedence over the previous access con trols, namely the MPE ￿le access matrix and loc kwords. The owner of a ￿le is an y of the follo wing: the creator of the ￿le, the accoun t manager (AM capabilit y) where the ￿le resides, or the system manager (SM capability).

A device or ￿le can be paired with an A CD. When a user tries to acquire the device or to open the ￿le, the system ￿rst c hecks the authorization list of the associated A CD. When a ￿le is paired with an A CD, the ACD is put into its ￿le label extension. The A CD contains a list of access modes paired with users.

Specifying and Restricting File Access

Similar to the MPE File Access System, A CDs use modes to specify the types of access to grant or refuse to users as follo ws:

Rread

Wwrite

Aappend

Llock

Xexecute

NONE

none (no access)

RACD

read and copy the ACD permission ￿le

ACDs are de￿ned in a similar manner as ￿le access modes. F or example:

ACD = (R,W:MGR.ACCTING, DENNIS.LEE; R:@.PAYROLL; A:@.@

MGR.ACCTING and DENNIS.LEE can read and write to the ￿le associated with this example ACD. Any user in PAYROLL can read it, and any user on the system can append to it. If a user is not giv en a permission, the user does not ha ve it.

Managing ACDs with Commands and Intrinsics

Use commands to manage A CDs interactively through the command in terpreter. Use intrinsics to manage A CDs in a program.

1.Creating ACDs

ACDs for ￿les ma y be created or owned by the system manager (SM capability), the account manager (AM capability) where the ￿le resides, or b y the creator of the ￿le. A CDs for devices can only be created or o wned by the system manager (SM capabilit y).

When creating a new ￿le with the COPY, FCOPY, or RESTORE commands, use parameters to create its ACD. Use the ALTSEC command or the HPACDPUT intrinsic to create an ACD for an existing device or ￿le.

6-42 File System