HP OpenVMS Guide to System Security: OpenVMS Version 8.4 > Chapter 4 Protecting Data

Specifying an Object's Class

Groups of objects that behave in a particular way and have a common set of attributes are divided into classes. Files, queues, and volumes are very common examples. As “Classes of Protected Objects” shows, the operating system supports 11 classes of protected objects.

When you modify the profile of an object, you need to specify the class of the object; otherwise, the SET SECURITY command assumes the object is a file.

For example, the following command sequence changes the profile of an object and uses the /CLASS qualifier to identify the object LNM$GROUP as a logical name table:

$ SET SECURITY /CLASS=LOGICAL_NAME_TABLE-
_$ /OWNER=ACCOUNTING /PROTECTION=(S:RWCD, O:RWCD, G:R, W:R)-
_$ /ACL=((IDENTIFIER=CHEKOV,ACCESS=CONTROL),-
_$ (IDENTIFIER=WU,ACCESS=READ+WRITE)) LNM$GROUP

The SET SECURITY command makes the Accounting group owner of the logical name table. It changes the protection code to allow read, write, create, and delete access for the owner and for system users and to limit group and world users to read access. Finally, it creates an ACL to allow control access for user Chekov and to allow read and write access for user Wu.

The SHOW SECURITY command displays the results of the changes:

$ SHOW SECURITY LNM$GROUP /CLASS=LOGICAL_NAME_TABLE
LNM$GROUP object of class LOGICAL_NAME_TABLE
Owner: [ACCOUNTING]
Protection: (System: RWCD, Owner: RWCD, Group: R, World: R)
Access Control List:
(IDENTIFIER=[USER,CHEKOV],ACCESS=CONTROL)
(IDENTIFIER=[USER,WU],ACCESS=READ+WRITE)

Table 4-2 Classes of Protected Objects

Class Name Definition

Capability

A resource to which the system controls access; currently, the only defined capability is the vector processor.

Common event flag cluster

A set of 32 event flags that enable cooperating processes to post event notifications to each other.

Device

A class of peripherals connected to a processor that are capable of receiving, storing, or transmitting data.

File

Files-11 On-Disk Structure Level 2 or 5 (ODS-2 or ODS-5) files and directories.

Group global section

A shareable memory section potentially available to all processes in the same group.

Logical name table

A shareable table of logical names and their equivalence names for the system or a particular group.

Queue

A set of jobs to be processed in a batch, terminal, server, or print job queue.

Resource domain

A namespace controlling access to the lock manager's resources.

Security class

A data structure containing the elements and management routines for all members of the security class.

System global section

A shareable memory section potentially available to all processes in the system.

Volume

A mass storage medium, such as a disk or tape, that is in ODS-2 or ODS-5 format. Volumes contain files and may be mounted on devices.

 

“Descriptions of Object Classes” for a detailed description of each class.