HP 3000 Manuals

Capabilities Table [ User's Guide to MPE/iX Security ] MPE/iX 5.0 Documentation


User's Guide to MPE/iX Security

Capabilities Table 

Table 4-1  lists MPE/iX capabilities and their standard abbreviations.
It also shows the types of users that require each capability.  Use the
information in Table 4-1  to establish capabilities for your system.

          Table 4-1.  Capability Assignments 

-------------------------------------------------------------------------------------------------------
|                                 |            |            |            |               |            |
|        Capability               |  Default   |  Program   |  Account   |    System     |   System   |
|                                 |    User    |            |  Manager   |  Supervisor   |  Manager   |
|                                 |            |            |            |               |            |
-------------------------------------------------------------------------------------------------------
|                                 |            |            |            |               |            |
| System manager            SM    |            |            |            |               |     X      |
|                                 |            |            |            |               |            |
| System supervisor         OP    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |
| Account manager           AM    |            |            |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Account librarian         AL    |            |            |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Batch access              BA    |     X      |     X      |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Use Communications        CS    |            |            |            |       X       |     X      |
| Software                        |            |            |            |               |            |
|                                 |            |            |            |               |            |
| Diagnostician             DI    |            |            |            |               |     X      |
|                                 |            |            |            |               |            |
| Extra Data Segments       DS    |            |     X      |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Group librarian           GL    |            |            |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Interactive access        IA    |     X      |     X      |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Multiple RIN              MR    |            |     X      |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
-------------------------------------------------------------------------------------------------------

          Table 4-1.  Capability Assignments (cont.) 

-------------------------------------------------------------------------------------------------------
|                                 |            |            |            |               |            |
|        Capability               |  Default   |  Program   |  Account   |    System     |   System   |
|                                 |    User    |            |  Manager   |  Supervisor   |  Manager   |
|                                 |            |            |            |               |            |
-------------------------------------------------------------------------------------------------------
|                                 |            |            |            |               |            |
| Network administrator     NA    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |
| Node manager              NM    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |
| Use nonshareable devices  ND    |     X      |            |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Use mounted volume sets   UV    |            |            |            |               |     X      |
|                                 |            |            |            |               |            |
| Privileged mode           PM    |            |     X      |            |               |     X      |
|                                 |            |            |            |               |            |
| Process handling          PH    |            |     X      |     X      |       X       |     X      |
|                                 |            |            |            |               |            |
| Programmatic sessions     PS    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |
| Save user files           SF    |     X      |            |     X      |       X       |     X      |
| permanently                     |            |            |            |               |            |
|                                 |            |            |            |               |            |
| Use user logging facility LG    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |

| Create volume sets        CV    |            |            |            |       X       |     X      |
|                                 |            |            |            |               |            |
-------------------------------------------------------------------------------------------------------

Account Librarian (AL) 

A librarian has special file access modes for maintaining files within
the account.  An account librarian can purge files within the account,
although not create or alter them.  This attribute is assigned by an
account manager.

Account Manager (AM) 

An account manager manages all users and groups in that account.  The
system manager designates the initial manager for each account when
creating the account.  The account manager can, in turn, assign the
attribute to other users in the account.

Batch Access (BA) 

This capability allows access to MPE/iX in a batch processing (job) mode.

Use Communications Software (CS) 

This capability allows users exclusive access to a communications device
such as a DSN/RJE line or a DSN/DS line.  It is a requirement in order to
use the DSN/RJE subsystem.

Diagnostician (DI) 

This capability permits users to run certain device and CPU verification
programs.  Normally only a Hewlett-Packard service representative
(customer engineer) needs this capability.

Extra Data Segments (DS) 

This capability lets users and programs create and manage extra data
segments.  Normally, a program uses these data segments for temporarily
storing large amounts of data.  Thus, the program's global data area
stays relatively small.  The extra data segment is purged at the end of
the program.  Programmers manage extra data segments through the GETDSEG,
FREEDSEG, DMOVIN, DMOVOUT, and ALTDSEG intrinsics.  For further
information, refer to the MPE/iX Intrinsics Reference Manual 
(32650-90028).

Group Librarian (GL) 

A group librarian has special file access modes for maintaining files
within the home group.  An account manager assigns this attribute.  An
account manager might, for example, assign group librarian capability to
a user with the ability to create and purge files, while assigning only
the ability to read and execute files to other users within the group.

Interactive Access (IA) 

This capability allows access to MPE/iX in an interactive (session) mode.

Multiple RIN (MR) 

This capability lets a user or program acquire more than one resource
identification number (RIN) for a single process.  It allows exclusive
use of more than one resource number simultaneously.


CAUTION If you assign MR capability, be sure that the multiple resources are correctly managed. If they are not, resource deadlocking can stop the system.
RINs are managed through the FREELOCRIN, GETLOCRIN, LOCGLORIN, LOCKLOCRIN, LOCRINOWNER, UNLOCKGLORIN, and UNLOCKLOCRIN intrinsics. For more information refer to the MPE/iX Intrinsics Reference Manual (32650-90028). Network Administrator (NA) This capability allows the use of NMMGR . PUB . SYS (the node management services configuration program) to configure NS and LAN and administer the resulting network. Node Manager (NM) This capability allows the use of NMMGR.PUB.SYS (the node management services configuration program) to configure and manage nodes in a local area network (LAN). Use Nonshareable Devices (ND) This capability allows the use of devices other than terminals and discs including spooled devices. If the device is not spooled, the user has complete control of it. Examples of nonshareable devices are card readers, line printers, magnetic tape units, and plotters. This capability is not needed to use the standard job or session input and list devices. Use Mountable Volume Sets (UV) This capability allows access to files residing on mountable volume sets. Privileged Mode (PM) Privileged mode gives a user or a program access to all MPE/iX resources, including intrinsics, privileged procedure calls, main memory, system tables and privileged CPU instructions. A program with this capability can run in a permanently privileged mode, or a temporarily privileged mode through the GETPRIVMODE, GETUSERRMODE, and SWITCHDB intrinsics. For further information, refer to the MPE/iX Intrinsics Reference Manual (32650-90028).
CAUTION Privileged mode bypasses the normal checks and limitations that apply to standard MPE/iX users. A privileged mode program can actually destroy file integrity, including the MPE/iX operating system software itself. Upon request, Hewlett-Packard will investigate and attempt to resolve problems resulting from the use of privileged mode code. This service is not available under the standard service contract, but is available on a time and materials billing basis. However, Hewlett-Packard will not support, correct, or attend to any modification of the MPE/iX operating system software.
Process Handling (PH) This capability allows the direct creation of other processes by executing the user process. It also allows process suspension, interprocess communication, and process deletion. With process handling capability, a program can use any of the following intrinsics: ACTIVATE, CREATE, FATHER, GETORIGIN, GETPRIORITY, GETPROCID, GETPROCINFO, KILL, MAIL, RECEIVEMAIL, SENDMAIL, SUSPEND, and TERMINATE. For further information, refer to the MPE/iX Intrinsics Reference Manual (32650-90028). Programmatic Sessions (PS) This capability permits the use of the STARTSESS command and STARTSESS intrinsic. You can assign this capability to any MPE/iX user. Usually applications programmers use it when creating turnkey systems. Save User Files Permanently (SF) This capability allows the use of the BUILD, SAVE, and RESTORE commands, and the SAVE option of the FILE command, described in the MPE/iX Commands Reference Manual Volumes 1 and 2 (32650-90003 and 32650-90364). Users without SF capability can create job or session temporary files that MPE/iX automatically deletes when the job or session ends. System Manager (SM) This capability gives its possessor the capability to manage the overall system, and create accounts within it. The initial person with system manager attribute is designated on the system tape furnished with the HP 3000 Computer System. The original system manager can create other users with SM capability. System Supervisor (OP) Users with system supervisor capability have day-to-day external control of the system. An account manager with OP capability can assign it to other users within the account. Use User Logging Facility (LG) This capability allows its owner to use user logging commands. Create Mountable Volume Sets (CV) This capability is needed to create, alter, and delete mountable volume sets. A user given CV capability automatically has UV capability.


MPE/iX 5.0 Documentation