topic Re: Backup does not create default ACL's in Operating System - OpenVMS

Backup does not create default ACL's

Carl Karcher — Mon, 20 Mar 2006 11:36:24 GMT

When copying files between ODS-5 volumes, backup fails to create default ACL's if the target directory specifies them and the input files have no ACL's. In effect, it's propagating the ACL's (none) of the input files even when that makes no sense. For example, consider the directory jones has simple UIC protection with no acl's in use and directory stemcell uses resource ID's and ACL's for security. The command:

$ backup user19:[jones.data...] project0:[stemcell.data...]/by_owner=parent

will copy the files setting the owner to that of the parent directory (a resource ID in this case) however no default acl's will be created on the output files making them unusable. A second step is required to re-establish the security of the output files:

$ set security/default project0:[stemcell.data...]*.*;*

Which will propagate the default acl's down the directory. This has the negative side effect of setting all the revision dates to now. On ODS-2 volumes, using the /interchange backup qualifier would work around this issue. Now, with ODS-5 volumes, using /interchange IMPLIES /convert which is not the desired result. It would be very useful if backup had an option to create default acl's for the target files (i.e. NOT preserve the ACL's of the input files).

Re: Backup does not create default ACL's

Ian Miller. — Mon, 20 Mar 2006 11:56:32 GMT

Parhaps you could go to
http://www.hpuseradvocacy.org/

and submit a new issue.

Re: Backup does not create default ACL's

Uwe Zessin — Mon, 20 Mar 2006 11:59:48 GMT

While I have no idea how to teach BACKUP do what you want, I have always had a need to reset a file's CDT + RDT. For that I wrote two procedures:

1) one procedure which uses F$FILE_ATTRIBUTES to query the creation and revision date and store it together with the file name in a data file.

2) another procedure which reads that data file and uses the |FILE| utility to change the CDT and RDT back to its old values.

I very well understand that this hides changes to a (group of) file(s) and that the changes (e.g. modification of ownership, protection mask or ACL) is not shipped in the next incremental backup.

Re: Backup does not create default ACL's

Bill Hall — Mon, 20 Mar 2006 13:35:45 GMT

Carl,

I believe you can use backup/interchange and /by_owner=parent as an output qualifier to do what you want. Backup/interchange does not save the input files' ACL. The output files will inherit default ACEes as you would expect. I seem to recall that the /by_owner=parent was necessary.

Bill

Re: Backup does not create default ACL's

Carl Karcher — Tue, 21 Mar 2006 11:11:43 GMT

Yes but that only works for ODS-2 volumes
(/interchange implies /convert)!

I'm going to open a support call on this.

Re: Backup does not create default ACL's

Bill Hall — Tue, 21 Mar 2006 11:55:15 GMT

Carl,

This does work if you use an intermediate on-disk saveset.

$ backup user19:[jones.data...] saveset.bck/save

$ backup/interchange saveset.bck/save project0:[stemcell.data...]/by_owner=parent

Use the /interchange qualifier only on the restore of the saveset.