Your Browser is not longer supported

Please use Google Chrome, Mozilla Firefox or Microsoft Edge to view the page correctly
Loading...

{{viewport.spaceProperty.prod}}

Examples of GUARDS commands

The following examples show how the GUARDS commands are used to define guards. A guard and an object are linked together via the interfaces of the related object management system. How this is done is shown at the end of the examples.

Example 1: Creating an access control

Problem

Access to the files of the project GUARDS is to be controlled with the aid of the guard GUARDPRO.

The project team consists of four persons with the user IDs GUARDS1, GUARDS2, GUARDS3 and GUARDS4.

The general working hours for all employees are from 07:00 to 19:00 on each day from Monday to Friday.

However, the person with user ID GUARDS3 is a part-time employee who works only on three days, Monday, Wednesday and Thursday.

The person with user ID GUARDS4 has a restricted contract which runs from 1 July 2017 to 30 September 2017, inclusive.

The user groups ONE and TWO are to have temporary access for the purpose of the reviews which are to take place on 23/24 August 2017 and 2/3 September 2017, in each case from 09:00 to 15:00.

Solution

Access conditions for the user ID GUARDS1 and GUARDS2 are entered in a guard with guard name GUARDPRO. This guard is automatically created during this operation.

/add-access-conditions guard-name=guardpro, -
/           subjects=*user(user-identification=guards1)
/add-access-conditions guard-name=guardpro, -
/           subjects=*user(user-identification=guards2)
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1  has ADMISSION
   User   GUARDS2  has ADMISSION
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display


Access conditions for part-time workers are now created:

/add-access-conditions guard-name=guardpro, -
/           subjects=*user(user-identification=guards3), -
/            admission=*parameters(weekday=(*monday, *wednesday,*thursday))
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1  has ADMISSION
   User   GUARDS2  has ADMISSION
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display


Access conditions are entered for personnel with the user ID GUARDS4 whose contracts are due to expire:

/add-access-conditions guard-name=guardpro, -
/       subjects=*user(user-identification=guards4), -
/            admission=*parameters( -
/             date=*interval(from=2017-07-01,to=2017-09-30))
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1  has ADMISSION
   User   GUARDS2  has ADMISSION
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
   User   GUARDS4
    Date      IN ( <2017-07-01,2017-09-30> ) 
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display


The working hours are defined for all employees:

/add-access-conditions guard-name=guardpro,subjects=*all-users, -
/           admission=*parameters(time=*interval(from=7,to=19),  -
/           weekday=*except(weekday=(*saturday,*sunday)))
/show-access-conditions guard-name=guardpro 

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1  has ADMISSION
   User   GUARDS2  has ADMISSION
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
   User   GUARDS4
    Date      IN ( <2017-07-01,2017-09-30> ) 
   Alluser
    Time      IN ( <07:00,19:00> )
    Weekday   EX ( SA, SU ) 
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display


Definition of the access conditions for the ONE and TWO groups:

/add-access-conditions guard-name=guardpro, -
/    subjects=*group(group-identification=(one,two)), -
/    admission=*parameters( -
/               date=(*interval(from=2017-08-23,to=2017-08-24), -
/                     *interval(from=2017-09-02,to=2017-09-03)), -
/               time=*interval(from=9,to=15))
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1  has ADMISSION
   User   GUARDS2  has ADMISSION
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
   User   GUARDS4
    Date      IN ( <2017-07-01,2017-09-30> ) 
   Group  ONE
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-02,2017-09-03> ) 
   Group  TWO
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-02,2017-09-03> ) 
   Alluser
    Time      IN ( <07:00,19:00> )
    Weekday   EX ( SA, SU ) 
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display

Example 2: Modifying the access conditions

Problem

The employee with user ID GUARDS1 goes on vacation from 15 October 2017 to 15 November 2017.

The employee with user ID GUARDS3 now works on Monday, Tuesday and Wednesday instead of Monday, Wednesday and Thursday.

The review planned for 2/3 September has been postponed and will now take place on 9/10 September.

Solution

/modify-access-conditions guard-name=guardpro, -
/       subjects=*user(user-identification=guards1), -
/       admission=*parameters(date= -
/             *except(date=*interval(from=17-10-15,to=17-11-15)))
/modify-access-conditions guard-name=guardpro, -
/       subjects=*user(user-identification=guards3), -
/       admission=*parameters(weekday=(*monday,*tuesday,*wednesday))
/modify-access-conditions guard-name=guardpro, -
/       subjects=*group(group-identification=(one,two)), -
/       admission=*parameters(date=( -
/                             *interval(from=17-08-23,to=17-08-24), -
/                             *interval(from=17-09-09,to=17-09-10)))
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1
    Date      EX ( <2017-10-15,2017-11-15> ) 
   User   GUARDS2  has ADMISSION
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
   User   GUARDS4
    Date      IN ( <2017-07-01,2017-09-30> ) 
   Group  ONE
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-09,2017-09-10> ) 
   Group  TWO
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-09,2017-09-10> ) 
   Alluser
    Time      IN ( <07:00,19:00> )
    Weekday   EX ( SA, SU ) 
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display

Example 3: Deleting an access condition
Problem

The employee with user ID GUARDS2 is moving to another company and this user ID is to be deleted from the guard.

Solution

/remove-access-conditions guard-name=guardpro, -
/       subjects=*user(user-identification=guards2)
/show-access-conditions guard-name=guardpro

:N:$SECOSMAN.GUARDPRO
   User   GUARDS1
    Date      EX ( <2017-10-15,2017-11-15> ) 
   User   GUARDS3
    Weekday   IN ( MO, WE, TH )
   User   GUARDS4
    Date      IN ( <2017-07-01,2017-09-30> ) 
   Group  ONE
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-09,2017-09-10> ) 
   Group  TWO
    Time      IN ( <09:00,15:00> ) 
    Date      IN ( <2017-08-23,2017-08-24> , <2017-09-09,2017-09-10> ) 
   Alluser
    Time      IN ( <07:00,19:00> )
    Weekday   EX ( SA, SU ) 
-----------------------------------------------------------------------------
Guards selected: 1                                             End of display

Example 4: Linking a file with the guard GUARDPRO

Problem

The file SECOS is to be linked with the guard GUARDPRO so that the guard’s access conditions apply to all accesses.

Solution

/modify-file-attributes file-name=secos, -
/    protection=*parameters(guards=*parameters(read=guardpro,write=guardpro))
/show-file-attributes file-name=secos,information=*parameters(security=yes)

00001266 :N:$SECOSMAN.SECOS
  ------------------------------- SECURITY     ------------------------------ 
  READ-PASS  = NONE        WRITE-PASS = NONE        EXEC-PASS  = NONE
  USER-ACC   = OWNER-ONLY  ACCESS     = WRITE       ACL        = NO
  AUDIT      = NONE        DESTROY    = YES         EXPIR-DATE = 2017-11-17
  SP-REL-LOCK= NO                                   EXPIR-TIME =   00:00:00
  GUARD-READ = $SECOSMAN.GUARDPRO
  GUARD-WRIT = $SECOSMAN.GUARDPRO
  GUARD-EXEC = NONE
:N:    PUBLIC:      1 FILE  RES=     1266  FREE=        2  REL=       0 PAGES


Example 5: Removing the link between guard and file

Problem

The file SECOS is no longer to be protected with the access conditions of the guard GUARDPRO, i.e. the link has to be removed. After removal of the GUARDS protection, the lower access protection mechanisms of the hierarchy come into effect.

Solution

/modify-file-attributes file-name=secos,protection=*parameters(guards=*none)
/show-file-attributes file-name=secos,information=*parameters(security=*yes)

00001266 :N:$SECOSMAN.SECOS
  ------------------------------- SECURITY     ------------------------------ 
  READ-PASS  = NONE        WRITE-PASS = NONE        EXEC-PASS  = NONE
  USER-ACC   = OWNER-ONLY  ACCESS     = WRITE       ACL        = NO
  AUDIT      = NONE        DESTROY    = YES         EXPIR-DATE = 2017-11-17
  SP-REL-LOCK= NO                                   EXPIR-TIME =   00:00:00
:N:    PUBLIC:      1 FILE  RES=     1266  FREE=        2  REL=       0 PAGES

Example 6: Setting up user-specific default protection

Problem

User USER1 wants to create all files whose names begin with ’FILE‘ in such a way that user USER2 has write access to them.

No pubset-global default protection is active.

Solution

USER 1 sets up a condition guard WRGUA1 with the access conditions for USER2:

He then creates an attribute guard ATTR1 in which he defines the default protection attribute that write access should be controlled via the condition guard WRGUA:

/create-guard attr1,user-inf='Guard for the default protection attributes'
/add-default-protection-attr guard-name=attr1,-
/                            guards=*parameters(write=wrgua1)

Finally he defines a rule container DEF1 for default protection. This contains a default protection rule which states that the default protection attributes of files which begin with ’FILE’ are defined in the attribute guard ATTR1:

/create-guard def1,user-inf='Default protection rule container'
/add-default-protection-rule rule-container-guard=def1,-
/            protection-rule=rule1, -
/            protect-object=*parameters(name=file*,attribute-guard=attr1)

For control purposes, USER1 outputs information about all the guards and the rule container DEF1. Precondition: no guards were present under the user ID USER1 at the start of this example session.

/show-guard-attributes

     Guard name         Scope   Type      Creation Date       LastMod Date
------------------------------------------------------------------------------
:DEL1:$USER1.ATTR1       USR  DEFPATTR 2017-04-20/07:48:09 2017-04-20/08:04:01
                         Guard for the default protection attributes
:DEL1:$USER1.DEF1        USR  DEFAULTP 2017-04-20/07:52:36 2017-04-20/08:11:11
                         Default protection rule container
:DEL1:$USER1.WRGUA1      USR  STDAC    2017-04-20/07:48:46 2017-04-20/07:49:17
                         Guard control for write access
------------------------------------------------------------------------------
Guards selected: 3                                              End of display

/show-default-protection-rule rule-container-guard=def1

------------------------------------------------------------------------------

RULE CONTAINER :DEL1:$USER1.DEF1                            DEFAULT PROTECTION
------------------------------------------------------------------------------
RULE1          OBJECT     = FILE*
               ATTRIBUTES = $USER1.ATTR1
               USER-IDS   = *ANY-USER-ID
------------------------------------------------------------------------------
RULE CONTAINER SELECTED: 1                                      END OF DISPLAY


Since the name of the rule container does not comply with the naming conventions for active rule containers, it is simply used for the preparation of the default rule. No default protection is as yet active for a file with the name FILE1 (corresponds to the wildcard specification FILE*) as the following command shows:

/show-object-protection-default file1

DEF3316 NO DEFAULT PROTECTION ACTIVE


To activate default protection, USER1 renames the inactive rule container DEF1:

/mod-guard-attr guard-name=def1,new-name=sys.udf
/show-guard-attributes

     Guard name         Scope   Type      Creation Date       LastMod Date
------------------------------------------------------------------------------
:DEL1:$USER1.ATTR1       USR  DEFPATTR 2017-04-20/07:48:09 2017-04-20/08:04:01
                         Guard for the default protection attributes
:DEL1:$USER1.SYS.UDF     USR  DEFAULTP 2017-04-20/07:52:36 2017-04-20/08:17:27
                         Default protection rule container
:DEL1:$USER1.WRGUA1      USR  STDAC    2017-04-20/07:48:46 2017-04-20/07:49:17
                         Guard protection for write access
------------------------------------------------------------------------------
Guards selected: 3                                              End of display


USER1 next displays the contents of this rule container which has now become active:

/show-object-protection-rule rule-container-guard=sys.udf

------------------------------------------------------------------------------
RULE CONTAINER :DEL1:$USER1.SYS.UDF             USR ACTIVE  DEFAULT PROTECTION
------------------------------------------------------------------------------
RULE1          OBJECT     = FILE*
               ATTRIBUTES = $USER1.ATTR1
               USER-IDS   = *ANY-USER-ID
------------------------------------------------------------------------------
RULE CONTAINER SELECTED: 1                                      END OF DISPLAY


Next, USER1 again checks which protection attributes the file FILE1 would receive on creation:

/show-object-protection-default object-name=file1
/                               information=*attribute-values

------------------------------------------------------------------------------
DEFAULTS FOR FILE  :DEL1:$USER1.FILE1
------------------------------------------------------------------------------
                   % SCOPE: CREATE-OBJECT        % SCOPE: MODIFY-OBJECT-ATTR
                   % --------------------------- % -------------------------- 
ACCESS             % *SYSTEM-STD                 % *SYSTEM-STD
USER-ACCESS        % *SYSTEM-STD                 % *SYSTEM-STD
BASIC-ACL          % *SYSTEM-STD                 % *SYSTEM-STD
GUARDS             % READ   =                    % READ   =
                   % WRITE  = $USER1.WRGUA1      % WRITE  = $USER1.WRGUA1
                   % EXEC   =                    % EXEC   =
READ-PASSWORD      % *SYSTEM-STD                 % *SYSTEM-STD
WRITE-PASSWORD     % *SYSTEM-STD                 % *SYSTEM-STD
EXEC-PASSWORD      % *SYSTEM-STD                 % *SYSTEM-STD
DESTROY-BY-DELETE  % *SYSTEM-STD                 % *SYSTEM-STD
SPACE-RELEASE-LOCK % *SYSTEM-STD                 % *SYSTEM-STD
EXPIRATION-DATE    % *SYSTEM-STD                 % *SYSTEM-STD
FREE-FOR-DELETION  % *SYSTEM-STD                 % *SYSTEM-STD
------------------------------------------------------------------------------
                                                                END OF DISPLAY


The desired default protection is active. USER1 creates the file FILE1.

/create-file file1
/show-file-attributes file1,security=*yes

00000003 :DEL1:$USER1.FILE1
  ------------------------------- SECURITY     -------------------------------
  READ-PASS  = NONE        WRITE-PASS = NONE        EXEC-PASS  = NONE
  USER-ACC   = OWNER-ONLY  ACCESS     = WRITE       ACL        = NO
  AUDIT      = NONE        FREE-DEL-D = *NONE       EXPIR-DATE = NONE
  DESTROY    = NO          FREE-DEL-T = *NONE       EXPIR-TIME = NONE
  SP-REL-LOCK= NO
  GUARD-READ = NONE
  GUARD-WRIT = $USER1.WRGUA1
  GUARD-EXEC = NONE
:DEL1: PUBLIC:      1 FILE RES=         3  FREE=        3  REL=        3 PAGES


As the output of the /SHOW-FILE-ATTRIBUTES command shows, the protection attribute for GUARD-WRIT has been taken over from the attribute guard ATTR1.

Next, USER1 wants to create a file FILE2. This name also matches the wildcard specification in the default protection rule:

/show-object-protection-default object-name=file2
/                               information=*attribute-values

------------------------------------------------------------------------------
DEFAULTS FOR FILE  :DEL1:$USER1.FILE2
------------------------------------------------------------------------------
                   % SCOPE: CREATE-OBJECT        % SCOPE: MODIFY-OBJECT-ATTR
                   % --------------------------- % -------------------------- 
ACCESS             % *SYSTEM-STD                 % *SYSTEM-STD
USER-ACCESS        % *SYSTEM-STD                 % *SYSTEM-STD
BASIC-ACL          % *SYSTEM-STD                 % *SYSTEM-STD
GUARDS             % READ   =                    % READ   =
                   % WRITE  = $USER1.WRGUA1      % WRITE  = $USER1.WRGUA1
                   % EXEC   =                    % EXEC   =
READ-PASSWORD      % *SYSTEM-STD                 % *SYSTEM-STD
WRITE-PASSWORD     % *SYSTEM-STD                 % *SYSTEM-STD
EXEC-PASSWORD      % *SYSTEM-STD                 % *SYSTEM-STD
DESTROY-BY-DELETE  % *SYSTEM-STD                 % *SYSTEM-STD
SPACE-RELEASE-LOCK % *SYSTEM-STD                 % *SYSTEM-STD
EXPIRATION-DATE    % *SYSTEM-STD                 % *SYSTEM-STD
FREE-FOR-DELETION  % *SYSTEM-STD                 % *SYSTEM-STD
------------------------------------------------------------------------------
                                                                END OF DISPLAY


However, USER1 wants to set up this file with the standard default protection attributes:

/create-file file2, protection=*parameters(protection-attr=*std)
/show-file-att file2,security=*yes

00000003 :DEL1:$USER1.FILE2
  ------------------------------- SECURITY     -------------------------------
  READ-PASS  = NONE        WRITE-PASS = NONE        EXEC-PASS  = NONE
  USER-ACC   = OWNER-ONLY  ACCESS     = WRITE       ACL        = NO
  AUDIT      = NONE        FREE-DEL-D = *NONE       EXPIR-DATE = NONE
  DESTROY    = NO          FREE-DEL-T = *NONE       EXPIR-TIME = NONE
  SP-REL-LOCK= NO
:DEL1: PUBLIC:      1 FILE RES=         3  FREE=        3  REL=        3 PAGES


All the protection attributes are set to the system defaults.

Example 7: Defining co-owners

Problem

USER1 wants USER2 to have the right to create and administer files whose names contain the string ‘TEST’ under her (USER1’s) user ID.

Solution

USER1 defines a condition guard COND1 which gives USER2 access at all times:

/create-guard cond1,user-inf='Access conditions for co-owner'
/add-access-conditions guard-name=cond1, -
/                      subjects=*user(user-identification=user2)

USER1 then defines a rule container COO1 containing a co-owner rule. This specifies that the access conditions for co-owners of files whose names match the pattern ’*TEST*’ are defined in the condition guard COND1:

/create-guard coo1,user-inf='Co-owner rule container'
/add-coowner-protection-rule rule-container-guard=coo1, -
/            protection-rule=rule1, -
/            protect-object=*parameters(name=*test*,-
/                                       condition-guard=cond1)

For control purposes, USER1 outputs information about all the guards and the rule container COO1. Precondition: no guards were present under the user ID USER1 at the start of this example session.

/show-guard-attributes

     Guard name         Scope   Type      Creation Date       LastMod Date
------------------------------------------------------------------------------
:DEL1:$USER1.COND1       USR  STDAC    2017-04-19/10:35:47 2017-04-19/10:36:33
                         Access conditions for co-owner
:DEL1:$USER1.COO1        USR  COOWNERP 2017-04-19/10:37:26 2017-04-19/10:38:53
                         Co-owner rule container
------------------------------------------------------------------------------
Guards selected: 2                                              End of display
/show-coowner-protection-rule coo1
------------------------------------------------------------------------------
RULE CONTAINER :DEL1:$USER1.COO1                            COOWNER PROTECTION
------------------------------------------------------------------------------
RULE1         OBJECT      = *TEST*
              CONDITIONS  = $USER1.COND1
              TSOS-ACCESS = SYSTEM-STD
------------------------------------------------------------------------------
RULE CONTAINER SELECTED: 1                                      END OF DISPLAY

Since the name of the rule container does not comply with the naming conventions for active rule containers, it is simply used for the preparation of the default rule. USER2 does not as yet possess co-owner authorization for files under the user ID USER1, as a call of the following command under the user ID USER2 shows:

/show-coowner admission-rule $user1.*

COO3316 NO COOWNER PROTECTION ACTIVE

To activate co-owner protection, USER1 renames the inactive rule container COO1:

/mod-guard-attr guard-name=coo1,new-name=sys.ucf
/show-guard-attributes

     Guard name         Scope   Type      Creation Date       LastMod Date
------------------------------------------------------------------------------
:DEL1:$USER1.COND1       USR  STDAC    2017-04-19/10:35:47 2017-04-19/10:36:33
                         Access conditions for co-owner
:DEL1:$USER1.SYS.UCF     USR  COOWNERP 2017-04-19/10:37:26 2017-04-19/11:29:53
                         Co-owner rule container
------------------------------------------------------------------------------
Guards selected: 2                                              End of display

Next, USER1 displays the contents of this rule container which has now become active:

/show-coowner-protection-rule

------------------------------------------------------------------------------
RULE CONTAINER :DEL1:$USER1.SYS.UCF                  ACTIVE COOWNER PROTECTION
------------------------------------------------------------------------------
RULE1         OBJECT      = *TEST*
              CONDITIONS  = $USER1.COND1
              TSOS-ACCESS = SYSTEM-STD
------------------------------------------------------------------------------
RULE CONTAINER SELECTED: 1                                      END OF DISPLAY

USER2 checks which rules make him a co-owner of files belonging to the user ID USER1:

/show-coowner-admission-rule $user1.*

------------------------------------------------------------------------------
COOWNER RULES FOR FILE  :DEL1:$USER1.*
------------------------------------------------------------------------------
RULE1          OBJECT     = *TEST*
               CONDITIONS = $USER1.COND1
------------------------------------------------------------------------------
RULES SELECTED: 1                                               END OF DISPLAY


USER2 can now create the file TESTTEST under $USER1:

/create-file $user1.testtest
/show-file-att $user1.testtest

0000003 :DEL1:$USER1.TESTTEST 
:DEL1: PUBLIC:    1 FILE    RES=    3  FREE=    3  REL=    3 PAGES



Powered by Atlassian Confluence and Scroll Viewport.