| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 454.1 | Execute Is Often a Subset Of Read... | XDELTA::HOFFMAN | Steve, OpenVMS Engineering | Fri Apr 11 1997 11:58 | 22 |
|
"Execute" on a file object is a subset of "read" and is a relatively
"soft" protection attribute -- in the case of a file containing an
executable image, one must read the object in order to execute it.
Depending on the specific type of object -- executable file, queue,
global section, etc -- involved, various security-relevent actions
may be taken. (Execute-only access causes the image activator to
effectively treat the image as if it were installed, for instance.)
"Execute" on a directory prohibits wildcard operations on the
directory. With "read", one can perform wildcard operations. In
either case, one can explicitly reference specific files in the
directory.
Realize that files can be directly accessed via FID, completely
bypassing any directory protection scheme. In other words, the
directory protections apply to the filename "namespace", and not
to the file contents.
Please see the security manual for details...
|
| 454.2 | | ALPHAZ::HARNEY | John A Harney | Fri Apr 11 1997 12:57 | 8 |
| re: .0
Also, please consider giving actual examples.
Depending on what you're doing to the file will determine which
protection gets checked, and for what.
\john
|
| 454.3 | | AUSS::GARSON | DECcharity Program Office | Sun Apr 13 1997 23:25 | 21 |
| re .0
> EXEC only protection on a file allows EXEC, READ, WRITE unless the parent
> directory overrides.
If I have not misunderstood, this statement is false.
If a file allows only EXECUTE access then attempts to READ it or WRITE
it will fail.
If you have a counterexample, please provide a log showing relevant
information (e.g. DIR/SEC on file and all parent directories, SHOW
PROC, SHOW PROC/PRIV, VMS version, commands used to access file).
> Shouldn't file protection override parent directory?
The protection on the directory affects whether you can find the file
using the directory. It does not affect what you can do to the file
once you have found it (with the proviso that some user-level operations
may attempt to access both the directory and the file and thereby give
the impression that the two protections are related).
|
| 454.4 | Please forgive .0 | NEWVAX::DISNEY | Jim Disney, phone 410-643-5578 | Wed Apr 16 1997 14:29 | 4 |
| My original note .0 is in fact false. I reported it based on customer
input. and in haste, I errantly replicated the problem (must have
forgotten, to turn off privs). After reading your posts, I tested
further and found you are right. I apologize for inconveniencing you.
|