HP UX 11i Role-based Access Control (RBAC) Software manual IPC Rules, Permissionlist

For example:

/* deny all permissions except read to entire system */ perm read /

/* except for this directory	*/
perm read,write,create,unlink	/var/opt/server

/* just read and write log files, not create them */ perm read,write /var/opt/server/logs

permissionor perm	Sets permissions for a file or directory.
permission_list	The types of permission you can apply to a file or directory are:
	• none: Denies all permissions to a file or directory.
	• read: Controls the read access to the object. If the object is a file,
	reading and executing the file is controlled. If the object is a
	directory, searching and listing the directory is controlled.
	Additionally, due to inheritance, reading of all files under the
	directory is controlled. Files must have read access in order to
	be opened for execution.
	• write: Controls the write access to the object. If the object is a file,
	writing to the file is controlled. If the object is a directory, due
	to inheritance, writing for all files under the directory is
	controlled.
	• create: Controls the ability to create objects. This applies to
	directory objects only. This is inherited by all directories under
	the specified directory.
	• unlink: Controls the ability to delete objects. This applies to
	directory objects only. This is inherited by all directories under
	the specified directory.
file_object	The full path name of the file or directory.

NOTE: To grant any permission on a file system object, the compartment must have a minimum of read permission on every directory above that object. For example, to grant read and write permissions on /var/opt/tmp/file1, you must grant read permissions on /var/opt/tmp, /var/opt, /var, and /.

IPC Rules

Interprocess communication (IPC) rules govern how processes use interprocess communication methods between compartments. IPC communication methods include direct process-to-process communication or shared access to an IPC object. When an object is associated with a process, the object exists in the same compartment as the process that created it. You define compartment rules to describe the relationship between the process accessing the object and the object being accessed. When the rule describes two processes communicating with each other, you treat the second process as an object. The default behavior for IPC objects is that all operations between different compartments are prohibited unless explicitly allowed by a rule.

There are two types of IPC rules. The syntax for the first rule type is as follows:

(grantaccess) (ptyfifouxsockipc) <compartment_name>

For example:

64 Compartments