topic Re: Letting unprivileged users initialize and mount tape devices in Operating System - OpenVMS

Letting unprivileged users initialize and mount tape devices

Allan Poulsen — Tue, 27 Feb 2007 02:51:12 GMT

Dear All

I have a problem where I have to let otherwise unprivileged users initalize, mount and use tape devices in an OpenVMS 7.3 Alpha Cluster. I know of the privileges MOUNT, OPER and VOLPRO. This however does not let an unprivileged user initialize or mount a system wide tape device. I certantly does not want the user to have SYSPRV for this operation. Do any of you know a way through this problem?

Re: Letting unprivileged users initialize and mount tape devices

Karl Rohwedder — Tue, 27 Feb 2007 03:17:34 GMT

You may set an ACL (SET SECURITY) on the tapedevice to allow specific users access.

regards Kalle

Re: Letting unprivileged users initialize and mount tape devices

Steven Schweda — Tue, 27 Feb 2007 03:48:30 GMT

Or just set the protection if you don't care
who does what. (An ACL lets you be more
selective, of course.) Around here (with me
being the only likely user), for example:

ALP $ show devi /full dlt

Magtape ALP$MKB400:, device type Quantum DLT4000 CPQ DRV, is online, record-
oriented device, file-oriented device,
[...]
Owner process ID 00000000 Dev Prot S:RWPL,O:RWPL,G:R,W:RWPL

Re: Letting unprivileged users initialize and mount tape devices

Allan Poulsen — Tue, 27 Feb 2007 04:26:05 GMT

Thank You Kalle and Steven

I should have thought of that. This clearly shows I still have a lot to learn in the VMS world...

Re: Letting unprivileged users initialize and mount tape devices

Robert Gezelter — Tue, 27 Feb 2007 04:52:37 GMT

Allan,

Please review the details of protecting devices in the OpenVMS Guide to System Security (available from the OpenVMS www site at http://www.hp.com/go/openvms )

It works quite well, also check out the details of using the ALLOCATE command. Private volumes are different from public volumes.

- Bob Gezelter, http://www.rlgsc.com

Re: Letting unprivileged users initialize and mount tape devices

John Abbott_2 — Tue, 27 Feb 2007 06:29:01 GMT

Some Example to get you started;

(old syntax)
$ set acl/object=device/acl=(ident=[*,*],access=none) 'device'
$ set acl/object=device/acl=(ident=[uic],access=read+write+control) 'device'
(still works under vms v8.2)

(current - check help, can recall from which version of vms...)
$ set security/class=device/acl=(ident=[uic],access=read+write+control) 'device'

Hope this helps.
John.