Default Protection ACE - Revision history

Darya.zelenina: added a link to the Default Protection page

2019-02-25T05:42:58Z

added a link to the Default Protection page

← Older revision		Revision as of 05:42, 25 February 2019
Line 1:		Line 1:
	A '''Default Protection ACE''' is an [[ACE\|Access Control Entry]] that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection code in the ACE is assigned to new files created in the directory (the protection of the existing files needs to be changed explicitly). The Default Protection ACE applies to [[Directory file\|directory files]] only. Although the system propagates the Default Protection ACE to new subdirectories, the protection code is not assigned to the subdirectories. Instead, the subdirectories receive a modified copy of the parent directory's protection code in which delete access is not granted.		A '''Default Protection ACE''' is an [[ACE\|Access Control Entry]] that defines a [[Default Protection\|UIC-based protection]] to be propagated to new files throughout a directory tree. The protection code in the ACE is assigned to new files created in the directory (the protection of the existing files needs to be changed explicitly). The Default Protection ACE applies to [[Directory file\|directory files]] only. Although the system propagates the Default Protection ACE to new subdirectories, the protection code is not assigned to the subdirectories. Instead, the subdirectories receive a modified copy of the parent directory's protection code in which delete access is not granted.
	An example of a Default Protection ACE is as follows:		An example of a Default Protection ACE is as follows:

Darya.zelenina: added an example

2019-02-25T05:41:56Z

added an example

@@ Line 51: / Line 51: @@
 When you omit a user category from a protection code, the current access allowed that category of user is set to no access.
 =See also=
 * {{Template:Sec}}
 [[Category:Security]]

Darya.zelenina: Added a warning about the fact that subj does not change protection of the existing files.

2019-02-16T05:22:40Z

Added a warning about the fact that subj does not change protection of the existing files.

← Older revision		Revision as of 05:22, 16 February 2019
Line 1:		Line 1:
	A '''Default Protection ACE''' is an [[ACE\|Access Control Entry]] that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection code in the ACE is assigned to new files created in the directory. The Default Protection ACE applies to [[Directory file\|directory files]] only. Although the system propagates the Default Protection ACE to new subdirectories, the protection code is not assigned to the subdirectories. Instead, the subdirectories receive a modified copy of the parent directory's protection code in which delete access is not granted.		A '''Default Protection ACE''' is an [[ACE\|Access Control Entry]] that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection code in the ACE is assigned to new files created in the directory (the protection of the existing files needs to be changed explicitly). The Default Protection ACE applies to [[Directory file\|directory files]] only. Although the system propagates the Default Protection ACE to new subdirectories, the protection code is not assigned to the subdirectories. Instead, the subdirectories receive a modified copy of the parent directory's protection code in which delete access is not granted.
	An example of a Default Protection ACE is as follows:		An example of a Default Protection ACE is as follows:

Darya.zelenina at 05:18, 16 February 2019

2019-02-16T05:18:33Z

← Older revision		Revision as of 05:18, 16 February 2019
Line 8:		Line 8:
	(DEFAULT_PROTECTION[,OPTIONS=attribute[+attribute...]],access)		(DEFAULT_PROTECTION[,OPTIONS=attribute[+attribute...]],access)

	==~~options~~==		==Options==
	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-
Line 33:		Line 33:
	\|}		\|}

	==~~access~~==		==Access==

	Specify access in the format of a [[UIC protection code]] as follows:		Specify access in the format of a [[UIC protection code]] as follows:
Line 50:		Line 50:

	When you omit a user category from a protection code, the current access allowed that category of user is set to no access.		When you omit a user category from a protection code, the current access allowed that category of user is set to no access.

			=See also=
			* {{Template:Sec}}

	[[Category:Security]]		[[Category:Security]]

Darya.zelenina at 08:49, 19 December 2018

2018-12-19T08:49:32Z

← Older revision		Revision as of 08:49, 19 December 2018
Line 50:		Line 50:

	When you omit a user category from a protection code, the current access allowed that category of user is set to no access.		When you omit a user category from a protection code, the current access allowed that category of user is set to no access.

			[[Category:Security]]

Darya.zelenina: Created page with "A '''Default Protection ACE''' is an Access Control Entry that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection..."

2018-08-23T05:34:14Z

Created page with "A '''Default Protection ACE''' is an Access Control Entry that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection..."

New page

A '''Default Protection ACE''' is an [[ACE|Access Control Entry]] that defines a UIC-based protection to be propagated to new files throughout a directory tree. The protection code in the ACE is assigned to new files created in the directory. The Default Protection ACE applies to [[Directory file|directory files]] only. Although the system propagates the Default Protection ACE to new subdirectories, the protection code is not assigned to the subdirectories. Instead, the subdirectories receive a modified copy of the parent directory's protection code in which delete access is not granted.
An example of a Default Protection ACE is as follows:

<pre>(DEFAULT_PROTECTION,S:RWED,O:RWED,G,W)</pre>

=Format=

(DEFAULT_PROTECTION[,OPTIONS=attribute[+attribute...]],access)

==options==
{| class="wikitable"
|-
| Hidden || Indicates that this ACE should be changed only by the application that adds it. Although the Hidden attribute is valid for any ACE type, its intended use is to hide Application ACEs. To delete or modify a hidden ACE, you must use the SET SECURITY command.
Users need the SECURITY privilege to display a hidden ACE with the DCL commands SHOW SECURITY or DIRECTORY/SECURITY. SECURITY privilege is also required to modify or delete a hidden ACE with the DCL command SET SECURITY. The ACL editor displays the ACE only to show its relative position within the ACL, not to facilitate editing of the ACE. To create a hidden ACE, an application can invoke the $SET_SECURITY system service.
|-
| Protected || Protects the ACE against casual deletion. Protected ACEs can be deleted only in the following ways:
* By using the ACL editor
* By specifying the ACE explicitly when deleting it
Use the command SET SECURITY/ACL=(ace)/DELETE to specify and delete an ACE.

By deleting all ACEs, both protected and unprotected
Use the command SET SECURITY/ACL/DELETE=ALL to delete all ACEs.

The following commands do not delete protected ACEs:

SET SECURITY/ACL/DELETE
SET SECURITY/LIKE
SET SECURITY/DEFAULT
|-
| Nopropagate || Indicates that the ACE cannot be copied by operations that usually propagate ACEs. For example, the ACE cannot be copied by the SET SECURITY/LIKE or SET SECURITY/DEFAULT commands.
|-
| None || Indicates that no attributes apply to an entry. Although you can create an ACL entry with OPTIONS=None, the attribute is not displayed. Whenever you specify additional attributes with the None attribute, the other attributes take precedence. The None attribute is equivalent to omitting the field.
|}

==access==

Specify access in the format of a [[UIC protection code]] as follows:

'''category: access types allowed (, category: access types allowed,...)]''', where

* '''category''' is S(ystem), O(wner), G(roup), W(orld)<br>
* '''access types''' allowed for files include
** READ
** WRITE
** EXECUTE
** DELETE
** CONTROL

A null access list means no access, so when you omit an access type for a user category, that category of user is denied that type of access. To deny all access to a user category, specify the user category without any access types. Omit the colon after the user category when you deny access to a category of users.

When you omit a user category from a protection code, the current access allowed that category of user is set to no access.