ALTSEC

Specifies the actual file designator, directory name, logical device number, or device class whose security provisions you want to alter.

Either MPE or hierarchical file system (HFS) file name Syntax may be used for the actual file designator of the file or directory whose access permissions are to be altered.

You can only use wildcard characters with MPE Syntax files that reside in a group.

A logical device number must be a numeric value configured on the system, or an @ sign, that indicates all devices on the system. A device class name must be configured on the system.

File equations are ignored during resolution of the object name to avoid having accidental file equation references cause unintentional changes to an object's access permissions.

MPE Syntax

You can include MPE file name Syntax but not RFA information. If the object is an MPE Syntax file, its format is:

  filename[/lockword][.groupname[.acctname]]

You may specify file lockwords for files protected by active lockwords unless the objects are also protected by a current ACD. In a batch job, if a lockword exists on a file, you must specify it. In a session, if a lockword exists and is omitted, MPE/iX will prompt you for it.

HFS Syntax

You must begin file designators using HFS file name Syntax with either a dot (.) or a slash (/). The maximum length is 255 characters (including the "./" or "/").

The objectname parameter is followed by one of the three type identifiers listed below.

Optional keyword that indicates a fileaccess specification follows. This option affects security at the file level only. If the file is protected by an ACD, the ACD overrides the file access mask.

File access mask specifications, entered as follows:

{ R L A W X } [,...] : { ANY AC GU AL GL CR } [,...]

The R, L, A, W, and X specify modes of access by types of users (ANY, AC, GU, AL, GL, CR) as follows:

  R  =  READ
  L  =  LOCK 
  A  =  APPEND 
  W  =  WRITE 
  X  =  EXECUTE

LOCK allows opening the file with dynamic locking option. APPEND implicitly specifies LOCK. WRITE implicitly specifies APPEND and LOCK. You may specify two or more modes if you separate them by commas.

The user types are specified as follows:

  ANY = Any user
  AC = Member of this account only
  GU = Member of this group only
  AL = Account librarian user only
  GL = Group librarian user only
  CR = Creator

You may specify two or more user types if you separate them by commas. The default is R,L,W,A,X:ANY. The colon (:) separating one or more modes from one or more user types is required punctuation in the specification of fileaccess.

Creates a new ACD for the specified object. NEWACD is used when an ACD does not currently exist. It must be followed by valid ACD pair(s) as described below.

Indicates "replace ACD". Use REPACD to replace an entire existing ACD for the specified object, or to copy an ACD from an existing objectname to the specified objectname where objectname refers to a file. (You cannot use REPACD to copy ACDs between devices.) The REPACD parameter must be followed by valid ACD pair(s) as described below.

Adds a new ACD pair to an existing ACD. It must be followed by valid ACD pair(s) as described below.

Replaces an existing ACD pair in an existing ACD. You must follow this with a valid ACD pair(s) as described below. A new ACD pair will replace an existing ACD pair if it has the same user and account name.

An access control definition pair. Like the fileaccess parameter this consists of a modes part and a userspec part. The modes part is separated from the userspec part by a colon (:). Acceptable modes for files are:

       R : read file access
       W : write file access
       L : lock file access
       A : append file access
       X : execute file access
     NONE : no access
     RACD : copy or read the ACD permission

Acceptable modes for directories are:

      CD : create directory entries access
      DD : delete directory entries access
      RD : read directory entries access
      TD : traverse directory entries access
     NONE : no access
     RACD : copy or read the ACD permission

File ACD pairs may contain R, W, L, A, X, NONE, and RACD. Directory ACD pairs may contain CD, DD, RD, TD, NONE, and RACD.

The userspec part consists of

A typical ACD consisting of three ACD pairs might look like this:

  (R,W:ENGR.MFG;R,W,RACD:@.MRKT;R:@.@)

This ACD would allow Read and Write access to the ENGR user of the MFG account; Read and Write access to any user of the MRKT account along with the ability to read or copy the ACD; and Read access to any user in any account.

A file containing one or more ACD pairs. ACD pairs must be separated by semi-colons and may be placed on separate lines. A single ACD pair may not span more than one line. The file name must be preceded by the ^ sign (caret symbol) to indicate that the designated file contains the ACD definition. This is known as an indirect file.

The ALTSEC command fails if the indirect file does not contain a syntactically correct ACD. ACD pairs may be on separate lines, but a pair may not span lines. Parentheses are optional when defining an acdpair within an indirect file.

The file reference may be specified using MPE or HFS file name Syntax. For example:

If the file has an active lockword, you must be specify it. ACDs override lockwords. Lockwords can only be specified in file references using MPE name Syntax. Unqualified file names are relative to the current working directory.

(Indicates "delete pair"). Use to delete one or more ACD pairs in an existing ACD). DELPAIR must be followed by a valid userspec.

Username and accountname, the same as the userspec described above in acdpair. A wildcard (@) may be used for the username or both the username and accountname together. A wildcard may not be specified for the accountname unless it is also specified for the username.

(Indicates "copy ACD"). Use COPYACD to copy an ACD from an existing objectname to the specified objectname. ACDs can be copied only between like objects. You must specify FILENAME or LDEV. FILENAME is the default. You cannot copy an ACD from a device class (DEVCLASS), although you may copy to all devices on the system by specifying the @ sign as the target device.

(Indicates "delete ACD"). Use DELACD to delete all ACD pairs from the specified objectname. ACDs may be removed only from devices and files in MPE groups. The file access matrix controls access to a file when an ACD is deleted.

(Indicates "recalculate MASK"). Use MASK to recalculate the ACD file group class mask ($GROUP_MASK) access permissions.

LISTF, LISTFILE, RELEASE, SECURE, SHOWDEV, and the fileaccess parameter for the ALTACCT, ALTGROUP, NEWACCT and NEWGROUP commands.

None