Re: Creating a directory but do not have authority to it.

Rob Berendt wrote on 12/12/2005 11:39:29 AM:

> Thank you.  But, although DAVEM was not listed in either /editpdta or
> /editpdta/userdata, *PUBLIC was.  and *PUBLIC had all of the specified
> authorities.  Shouldn't it have used that?

The MD command did use the public authority when it allowed DAVEM to create
the /elpfilef directory in /userdata. Also, *INDIR caused the public and
private authorities to be copied from the parent to the child directory. I
was wrong about *INDIR also controlling the owners authority to a new
object. What I learned is that an owner of an object created into a
directory will always have the same object authority as the owner of the
parent directory has to that parent directory. Also, because DAVEM is the
owner of the new directory he is given *RWX data authority to it. (My
understanding is that there are warnings in the Tips and Tools Security
book to not remove an owners object authorities to their directory
objects.)

If DAVEM had no data or object authority to the /elpfilef directory he
would be able to delete it because *PUBLIC has all authority to it and at
least *WX authority to its parent. But as long a DAVEM has some authority
to /elpfilef then *PUBLIC authority does not matter for him. Of course
since he is the owner of /elpfilef he should be allowed change his own
authority to it, and after he does that he can delete the directory.

Ed Fishel,
edfishel@xxxxxxxxxx