Re: Directory Trees on the IFS (Security)

[edfishel@xxxxxxxxxx]

Jeffrey,
>This is what I thought but if I give a user autorization at Level 3
>of a tree, does it not cascade up or down from there ???

No it does not cascade up and down from a specific directory. When you use
CRTDIR or MKDIR to create a new directory the default is to set the public,
private, and primary group authority of the new directory to the same as
its parent.  (See the DTAAUT and OBJAUT parameters on those commands.)
After the directory is created these can be changed if you do not like the
results. In fact it will probably be to your advantage to set the
authorities correctly on the root and all other directories before creating
any more home directories. To slightly contradict my previous note, you may
want to set the directory that will contain all the home directories to
have only public *X authorities and no private authorities. Then when you
create a home directory use DTAAUT(*EXCLUDE) OBJAUT(*NONE) on the CRTDIR
command. The last step to creating a home directory would be transferring
the ownership of it the correct person and making sure they have *RWX
authority to it. Now when they create new objects in their home directory
their authority will default so that they can modify those objects and no
one else (except an *ALLOBJ user) can even see those objects.

Ed Fishel,
edfishel@US.IBM.COM


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---