| Paul,
Huh, I dont understand this! The eventlist as an
action routine runs under UIC
1,4 so should be able to save its settings in
CONSOLE$APP_DEFAULTS:, if its an interactive job
then it should save its settings in the users
SYS$LOGIN: directory. This is in fact what happens
on my system.
As for the protections in Console$Logfiles, this
is correct, they should be protected against
non-priv'd user access. All the Console Manager
images should get installed with the necessary
privs to access these files.
As far as INSPECT is concerned, we didnt have too
much time to check out our compliance, it was fairly
low down on our list as it isnt a mandatory item
as far as engineering groups are concerned (it isnt
in our checklist). having said that, when we get
some more time in future releases, we will be making
the software compliant.
Cheers,
Phil
|
| 1)
What I'm doing is starting the C3 interface and then changing a couple of items
from the Eventlist window (Startup - Iconified) then Save Options.
I then get a securitty message on the comsole of the CM system:-
Security alarm (SECURITY) and security audit (SECURITY) on TMCPCM, system id: 64
515
Auditable event: Object access
Event information: directory entry creation request (IO$_ACCESS, IO$_CREA
TE, or IO$_ENTER)
Event time: 23-MAY-1994 14:26:31.30
PID: 00000390 Parent PID: 0000037F
Process name: ROWELL_1 Parent process name: NET_8481
Username: ROWELL Parent username: ROWELL
Process owner: [ROWELL]
Image name: $222$DIA12:[CONSOLE.][ACTIONS.SYSTEM]CONSOLE$EVENTLIST
.EXE
Object class name: FILE
Object owner: [SYSTEM]
Object protection: SYSTEM:RWE, OWNER:RWE, GROUP:RE, WORLD:E
Directory name: _$222$DIA12:[CONSOLE]APP-DEFAULTS.DIR;1
Directory ID: (25,1,0)
Directory entry: CONSOLE$EVENTLIST.DAT_ROWELL_C3;0
Access requested: READ,WRITE
Sequence key: 0021DFC9
Status: %SYSTEM-F-NOPRIV, insufficient privilege or object pro
tection violation
2)If I do an Commands -> Console Manager -> Event History, I get a window saying
One or more log files for the selected system do not exist and another security
message:
%%%%%%%%%%% OPCOM 23-MAY-1994 14:35:34.45 %%%%%%%%%%%
Message from user AUDIT$SERVER on TMCPCM
Security alarm (SECURITY) and security audit (SECURITY) on TMCPCM, system id: 64
515
Auditable event: Object access
Event information: file access request (IO$_ACCESS or IO$_CREATE)
Event time: 23-MAY-1994 14:35:34.45
PID: 0000037F
Process name: NET_8481
Username: ROWELL
Process owner: [ROWELL]
Image name: $222$DIA12:[CONSOLE.][IMAGES]CONSOLE$C3.EXE
Object class name: FILE
Object owner: [SYSTEM]
Object protection: SYSTEM:RWED, OWNER:RWED, GROUP:RE, WORLD:
File name: _$222$DIA12:[CONSOLE.LOG]CONSOLEMANAGER.TIMES;1
File ID: (166,1,0)
Access requested: READ
Sequence key: 0021F12E
Status: %SYSTEM-F-NOPRIV, insufficient privilege or object pro
tection violation
3) The remark about INSPECT was tongue in cheek - I wonder how much time the
corporation wastes trying to get Inspect to pass after installing the latest
layered product! Seriously though it can't be wise allowing the whole world
total access to this data file.
The only privilege the images are installed with is SYSLCK is this correct?
If this still isn't clear don't hesitate to call me! (841-3980)
-Paul
|
| Ahhh,
The mists clear...
1) It appears that you have a scenario we missed in our testing,
dont ask me how, I dont know!!
As a workaround until we can sort this out, you are going to
have to give W:RW to the APP-DEFAULTS directory, but I guess
you already sussed that one.
2) Another protection problem I am afraid, and you are not going
to like the answer here, but, can you set the protection on all
the files in your log and archive directories to W:R that should
then at least allow your non-prived users to get to the data.
3) Your INSPECT comment may well have been tongue in cheek, but
we do realize that not complying causes internal users a
headache, so we would like to sort it out at some point.
4) Yup, everything should have SYSLCK as we do some lock
management between the processes.
Cheers,
Phil
|
| OK,
This is what I have done for the next release (V1.5) which
will be available within the next 3-4 months:-
a DIR/PROT of CONSOLE$ROOT:[000000] will look like this...
Directory CONSOLE$ROOT:[000000]
ACTIONS.DIR;1 (RWE,RWE,RE,E)
APP-DEFAULTS.DIR;1 (RWE,RWE,RE,E)
ARCHIVE.DIR;1 (RWE,RWE,RE,RE)
BOOKS.DIR;1 (RWE,RWE,RE,E)
DATA.DIR;1 (RWE,RWE,RE,E)
EXAMPLES.DIR;1 (RWE,RWE,RE,E)
ICONS.DIR;1 (RWE,RWE,RE,E)
IMAGES.DIR;1 (RWE,RWE,RE,E)
LOG.DIR;1 (RWE,RWE,RE,E)
TEMP.DIR;1 (RWE,RWE,RE,E)
TEMPLATES.DIR;1 (RWE,RWE,RE,E)
Total of 11 files.
The Archive directory has to have W:RE as the Extract
and Monitor interfaces need to do wild card searches
for archive files when either an extract or review is
done.
And all your log files will have a protection
of S:RWED,O:RWED,:,G:R,W:R
Now, as I said, this all passes DECinspect so everyone
should be happy, right!!
Cheers,
Phil
|