Capabilities Table [ User's Guide to MPE/iX Security ] MPE/iX 5.0 Documentation
User's Guide to MPE/iX Security
Capabilities Table
Table 4-1 lists MPE/iX capabilities and their standard abbreviations.
It also shows the types of users that require each capability. Use the
information in Table 4-1 to establish capabilities for your system.
Table 4-1. Capability Assignments
-------------------------------------------------------------------------------------------------------
| | | | | | |
| Capability | Default | Program | Account | System | System |
| | User | | Manager | Supervisor | Manager |
| | | | | | |
-------------------------------------------------------------------------------------------------------
| | | | | | |
| System manager SM | | | | | X |
| | | | | | |
| System supervisor OP | | | | X | X |
| | | | | | |
| Account manager AM | | | X | X | X |
| | | | | | |
| Account librarian AL | | | X | X | X |
| | | | | | |
| Batch access BA | X | X | X | X | X |
| | | | | | |
| Use Communications CS | | | | X | X |
| Software | | | | | |
| | | | | | |
| Diagnostician DI | | | | | X |
| | | | | | |
| Extra Data Segments DS | | X | X | X | X |
| | | | | | |
| Group librarian GL | | | X | X | X |
| | | | | | |
| Interactive access IA | X | X | X | X | X |
| | | | | | |
| Multiple RIN MR | | X | X | X | X |
| | | | | | |
-------------------------------------------------------------------------------------------------------
Table 4-1. Capability Assignments (cont.)
-------------------------------------------------------------------------------------------------------
| | | | | | |
| Capability | Default | Program | Account | System | System |
| | User | | Manager | Supervisor | Manager |
| | | | | | |
-------------------------------------------------------------------------------------------------------
| | | | | | |
| Network administrator NA | | | | X | X |
| | | | | | |
| Node manager NM | | | | X | X |
| | | | | | |
| Use nonshareable devices ND | X | | X | X | X |
| | | | | | |
| Use mounted volume sets UV | | | | | X |
| | | | | | |
| Privileged mode PM | | X | | | X |
| | | | | | |
| Process handling PH | | X | X | X | X |
| | | | | | |
| Programmatic sessions PS | | | | X | X |
| | | | | | |
| Save user files SF | X | | X | X | X |
| permanently | | | | | |
| | | | | | |
| Use user logging facility LG | | | | X | X |
| | | | | | |
| Create volume sets CV | | | | X | X |
| | | | | | |
-------------------------------------------------------------------------------------------------------
Account Librarian (AL)
A librarian has special file access modes for maintaining files within
the account. An account librarian can purge files within the account,
although not create or alter them. This attribute is assigned by an
account manager.
Account Manager (AM)
An account manager manages all users and groups in that account. The
system manager designates the initial manager for each account when
creating the account. The account manager can, in turn, assign the
attribute to other users in the account.
Batch Access (BA)
This capability allows access to MPE/iX in a batch processing (job) mode.
Use Communications Software (CS)
This capability allows users exclusive access to a communications device
such as a DSN/RJE line or a DSN/DS line. It is a requirement in order to
use the DSN/RJE subsystem.
Diagnostician (DI)
This capability permits users to run certain device and CPU verification
programs. Normally only a Hewlett-Packard service representative
(customer engineer) needs this capability.
Extra Data Segments (DS)
This capability lets users and programs create and manage extra data
segments. Normally, a program uses these data segments for temporarily
storing large amounts of data. Thus, the program's global data area
stays relatively small. The extra data segment is purged at the end of
the program. Programmers manage extra data segments through the GETDSEG,
FREEDSEG, DMOVIN, DMOVOUT, and ALTDSEG intrinsics. For further
information, refer to the MPE/iX Intrinsics Reference Manual
(32650-90028).
Group Librarian (GL)
A group librarian has special file access modes for maintaining files
within the home group. An account manager assigns this attribute. An
account manager might, for example, assign group librarian capability to
a user with the ability to create and purge files, while assigning only
the ability to read and execute files to other users within the group.
Interactive Access (IA)
This capability allows access to MPE/iX in an interactive (session) mode.
Multiple RIN (MR)
This capability lets a user or program acquire more than one resource
identification number (RIN) for a single process. It allows exclusive
use of more than one resource number simultaneously.
CAUTION If you assign MR capability, be sure that the multiple resources
are correctly managed. If they are not, resource deadlocking
can stop the system.
RINs are managed through the FREELOCRIN, GETLOCRIN, LOCGLORIN,
LOCKLOCRIN, LOCRINOWNER, UNLOCKGLORIN, and UNLOCKLOCRIN intrinsics. For
more information refer to the MPE/iX Intrinsics Reference Manual
(32650-90028).
Network Administrator (NA)
This capability allows the use of NMMGR . PUB . SYS (the node management
services configuration program) to configure NS and LAN and administer
the resulting network.
Node Manager (NM)
This capability allows the use of NMMGR.PUB.SYS (the node management
services configuration program) to configure and manage nodes in a local
area network (LAN).
Use Nonshareable Devices (ND)
This capability allows the use of devices other than terminals and discs
including spooled devices. If the device is not spooled, the user has
complete control of it. Examples of nonshareable devices are card
readers, line printers, magnetic tape units, and plotters. This
capability is not needed to use the standard job or session input and
list devices.
Use Mountable Volume Sets (UV)
This capability allows access to files residing on mountable volume sets.
Privileged Mode (PM)
Privileged mode gives a user or a program access to all MPE/iX resources,
including intrinsics, privileged procedure calls, main memory, system
tables and privileged CPU instructions. A program with this capability
can run in a permanently privileged mode, or a temporarily privileged
mode through the GETPRIVMODE, GETUSERRMODE, and SWITCHDB intrinsics. For
further information, refer to the MPE/iX Intrinsics Reference Manual
(32650-90028).
CAUTION Privileged mode bypasses the normal checks and limitations that
apply to standard MPE/iX users. A privileged mode program can
actually destroy file integrity, including the MPE/iX operating
system software itself. Upon request, Hewlett-Packard will
investigate and attempt to resolve problems resulting from the
use of privileged mode code. This service is not available
under the standard service contract, but is available on a time
and materials billing basis. However, Hewlett-Packard will not
support, correct, or attend to any modification of the MPE/iX
operating system software.
Process Handling (PH)
This capability allows the direct creation of other processes by
executing the user process. It also allows process suspension,
interprocess communication, and process deletion.
With process handling capability, a program can use any of the following
intrinsics: ACTIVATE, CREATE, FATHER, GETORIGIN, GETPRIORITY, GETPROCID,
GETPROCINFO, KILL, MAIL, RECEIVEMAIL, SENDMAIL, SUSPEND, and TERMINATE.
For further information, refer to the MPE/iX Intrinsics Reference Manual
(32650-90028).
Programmatic Sessions (PS)
This capability permits the use of the STARTSESS command and STARTSESS
intrinsic. You can assign this capability to any MPE/iX user. Usually
applications programmers use it when creating turnkey systems.
Save User Files Permanently (SF)
This capability allows the use of the BUILD, SAVE, and RESTORE commands,
and the SAVE option of the FILE command, described in the MPE/iX Commands
Reference Manual Volumes 1 and 2 (32650-90003 and 32650-90364). Users
without SF capability can create job or session temporary files that
MPE/iX automatically deletes when the job or session ends.
System Manager (SM)
This capability gives its possessor the capability to manage the overall
system, and create accounts within it. The initial person with system
manager attribute is designated on the system tape furnished with the HP
3000 Computer System. The original system manager can create other users
with SM capability.
System Supervisor (OP)
Users with system supervisor capability have day-to-day external control
of the system. An account manager with OP capability can assign it to
other users within the account.
Use User Logging Facility (LG)
This capability allows its owner to use user logging commands.
Create Mountable Volume Sets (CV)
This capability is needed to create, alter, and delete mountable volume
sets. A user given CV capability automatically has UV capability.
MPE/iX 5.0 Documentation