topic Re: How to identify objects that have an ACL. in Operating System - OpenVMS

How to identify objects that have an ACL.

djk — Thu, 08 Jul 2010 21:35:56 GMT

Is there an elegant method of searching across a file system for objects that have a specific ACL?

DIR/ACL [-...] /PAGE=SAVE /SEARCH="TECHSRVC" produces a lot of noise for everything.

Re: How to identify objects that have an ACL.

Hoff — Thu, 08 Jul 2010 21:55:34 GMT

Mac OS X does have tools to do this, yes. Oh, sorry, you asked for "elegant". My bad.

Guessing much around your question, have a look at the ACL scrubbing tool available here:

http://labs.hoffmanlabs.com/node/426

This tool can locate specific identifiers, and can optionally delete them. And I wouldn't call it "elegant".

Re: How to identify objects that have an ACL.

P Muralidhar Kini — Fri, 09 Jul 2010 02:53:15 GMT

Hi,

>> Is there an elegant method of searching across a file system for objects that
>> have a specific ACL?
The DIR command has a /ACL qualifier but it does not take any values.
Hence you need to take the output of DIR/ACL ... and do some parsing for the
ACL's that you are intrested in.

>>DIR/ACL [-...] /PAGE=SAVE /SEARCH="TECHSRVC" produces a lot of noise
>> for everything.
I guess you are referring to SEARCH returning matches for "TECHSRVC" which
are not identifiers. (say a directory name or filename or something like that).
Is that what you mean by noise ?

If thats the case then, you could use /SEARCH="IDENTIFIER=[TECHSRVC]"
instead of /SEARCH="TECHSRVC" to get more filtered data.

Also, my initial thought was that a PIPE command should help you out.
I tried the following thing, but it does NOT work -
$pipe dir/acl [-...] | search sys$pipe "identifier=techsrvc"/window=(1,1)

Looks like the /window is not allowed in the above command. But without the
/window you would not get the filename listed along with the identifiers.

In case the above suggestion does not help much then you may want to hunt
around for some tools, like the one Hoff has suggested.

Hope this helps.

Regards,
Murali

Re: How to identify objects that have an ACL.

Shriniketan Bhagwat — Fri, 09 Jul 2010 03:11:55 GMT

Hi,

There are few commands which you can use to list the ACL. For example: $ DIR/ACL, $ SHOW SECURITY etc. But with these commands you can not search the specific ACL. As Murali said you need to use $ PIPE command to search the specific ACL from the out put of $ DIR command like one shown below.

$ PIPE DIR/ACL | SEARCH SYS$PIPE â IDENTIFIER=ident_nameâ /WINDOW=(n1,n2)

Regards,
Ketan

Re: How to identify objects that have an ACL.

P Muralidhar Kini — Fri, 09 Jul 2010 03:36:21 GMT

Ketan,

When using the Pipe command, this is what i got -

* PIPE command works fine when SEARCH has /WINDOW=(0,0).
$PIPE DIR/ACL | SEARCH SYS$PIPE "IDENTIFIER=[MURALI]" /WINDOW=(0,0)
(IDENTIFIER=[MURALI],ACCESS=READ)
(IDENTIFIER=[MURALI],ACCESS=WRITE)
(IDENTIFIER=[MURALI],ACCESS=DELETE)

*PIPE command works fine when the /WINDOW has to go forward fetch data
(But then it does give you the filenames that you want).
$PIPE DIR/ACL | SEARCH SYS$PIPE "IDENTIFIER=[MURALI]" /WINDOW=(0,1)
(IDENTIFIER=[MURALI],ACCESS=READ)
B.TXT;1
***************
(IDENTIFIER=[MURALI],ACCESS=WRITE)
C.TXT;1
***************
(IDENTIFIER=[MURALI],ACCESS=DELETE)
D.TXT;1
$

* PIPE command does **NOT** work when /WINDOW has to go back some
lines to fetch data. This is what would have given all the files with the specific ACL's.
$PIPE DIR/ACL | SEARCH SYS$PIPE "IDENTIFIER=[MURALI]" /WINDOW=(1,0)
%SEARCH-F-RFAERR, RMS error using RFA access: RFA = 0, 0
-RMS-F-RAC, invalid record access mode
$

In specific /WINDOW(0,1) works but not /WINDOW(1,0) in a PIPE/SEARCH
combination. Looks like when a matching entry is found, we cannot go behind
'n' lines in SYS$PIPE but only can go ahead 'n' lines.

Regards,
Murali

Re: How to identify objects that have an ACL.

Shriniketan Bhagwat — Fri, 09 Jul 2010 04:00:06 GMT

Murali,

Interesting. Thanks for the clarification. So we need to use /WINDOW=(0,1) to print the file name along with the ACL.

Regards,
Ketan

Re: How to identify objects that have an ACL.

Joseph Huber_1 — Fri, 09 Jul 2010 05:34:43 GMT

[
*PIPE command works fine when the /WINDOW has to go forward fetch data
(But then it does give you the filenames that you want).
$PIPE DIR/ACL | SEARCH SYS$PIPE "IDENTIFIER=[MURALI]" /WINDOW=(0,1)
]

Sorry, no, if I see it right, this displays the ACL, followed by the next line, which is either another ACL or the NEXT file-name.
I think there is no way other to write a DCL procedure to wade through the DIR/ACL output,
or write a program using ACP functions to get the ACL information.
See e.g. the routine GETACL in Arne's
http://www.mpp.mpg.de/~huber/vmssig/src/MAR/ACL.MAR

Re: How to identify objects that have an ACL.

P Muralidhar Kini — Fri, 09 Jul 2010 06:32:09 GMT

Joseph,

>> Sorry, no, if I see it right, this displays the ACL, followed by the next line,
>> which is either another ACL or the NEXT file-name.
Yes, you are right.

Its a Typo in my previous response.

My statement
>> (But then it does give you the filenames that you want).

should have been

>> But then it *** does NOT *** give you the filenames that you want.

Ahh. Typo completely changed the meaning of the statement :)

/WINDOW(1,0) is what we want but then that does not work with PIPE and
hence cannot be used for the mentioned requirement.

>> See e.g. the routine GETACL in Arne's
>> http://www.mpp.mpg.de/~huber/vmssig/src/MAR/ACL.MAR
If i click on the link, the program does not seem to have the formatting.
Not sure if the problem with the program formatting itself or with my browser.

Regards,
Murali

Re: How to identify objects that have an ACL.

Joseph Huber_1 — Fri, 09 Jul 2010 06:45:37 GMT

[
http://www.mpp.mpg.de/~huber/vmssig/src/MAR/ACL.MAR
]

I bet it's Your browser, and it is MSIE having problems.

See the note about MSIE on the bottom of the page above /MAR (.../~huber/vmssig/src/)
or simply download the page instead of displaying it in the browser.

Re: How to identify objects that have an ACL.

P Muralidhar Kini — Fri, 09 Jul 2010 07:01:35 GMT

Joseph,

>> I bet it's Your browser, and it is MSIE having problems.
Yes, must be.

I used the VIEW->SOURCE in browser and that helped. Thanks.
I will use the program some time later.

Regards,
Murali

Re: How to identify objects that have an ACL.

Joseph Huber_1 — Fri, 09 Jul 2010 07:16:52 GMT

I just tested the GETACL routine (using Arnes fortran test program provided with acl.mar), and it works (just needs to remove the "IV" from the register save masks on Alpha (and IA64 ).

To get a program for the task the OP wants to do, a simple loop can be programmed:

lib$find_file() with the (wildcard-) filename
getacl() for each file found.

Re: How to identify objects that have an ACL.

Ian Miller. — Fri, 09 Jul 2010 07:47:15 GMT

you can use DFU SEARCH/ACE to search for files with a acl containing a specified identifier

http://www.digiater.nl/dfu.html

Re: How to identify objects that have an ACL.

Shriniketan Bhagwat — Fri, 09 Jul 2010 08:49:10 GMT

Hi,

Yes, you can use DFU SEARCH/ACE to search the files which have an ACE containing the specific identifier. The format is shown as below.

DFU SEARCH/ACE=identifier

Please refer the below link for more help on DFU usage and its qualifiers.

http://www.digiater.nl/downloads/dfu032.pdf

Regards,
Ketan

Re: How to identify objects that have an ACL.

The Brit — Fri, 09 Jul 2010 11:18:11 GMT

Try

$ dir /select=ACL []

(never used it myself)

Dave

Re: How to identify objects that have an ACL.

The Brit — Fri, 09 Jul 2010 11:21:41 GMT

The "dir /select=ACL" does not allow searching for a specific ACL. It will however list all files which have an ACL (and assuming you have the privilege, it will display the ACL also).

If you do not have privilege, it lists the files but does not show the ACL's.

Dave.

Re: How to identify objects that have an ACL.

Joseph Huber_1 — Fri, 09 Jul 2010 11:48:05 GMT

I did a quick hack using the above ACL.MAR in a fortran program, if You like it, it is at
http://wwwvms.mpp.mpg.de/~huber/util/main/

fetch the files
getacl.FPP,getacl_cli_table.cld,make_getacl.com

or the executable
http://wwwvms.mpp.mpg.de/vms$common/exe/getacl.EXE

for Alpha VMS 7.3-1+ .

$Â getacl/help
GETACL/IDENT=identifier filenamelist

$ getacl/ident=huber [...]
DISK$HUBER:[HUBER.util.main]address.tmp;1 Ident: HUBER Access: RWEDC
DISK$HUBER:[HUBER.util.main]tmp.tmp;1 Ident: HUBER Access: RWEDC

Re: How to identify objects that have an ACL.

djk — Fri, 09 Jul 2010 18:48:05 GMT

Information was very helpfull.