Operating System - OpenVMS
1748021 Members
4861 Online
108757 Solutions
New Discussion юеВ

Re: A tool to delete all Pathworks ACEs ?

 
SOLVED
Go to solution
Jeremy Begg
Trusted Contributor

A tool to delete all Pathworks ACEs ?

Hi,

Running CIFS V1.1-ECO1 PS006 on OpenVMS IA64 V8.3-1H1.

We've discovered that CIFS is tripping up on Pathworks ACEs: if the file has a Pathworks ACE, the Windows client can't delete or rename the file.

I've identified 13,000 files with Pathworks ACEs and now I'm wondering how to remove those ACEs. The DCL command

$ SET SECURITY/ACL=(ace)/DELETE

doesn't work because the Pathworks ACEs are too long for DCL's command buffer.

Does anyone know of a tool which can delete these ACEs?

Thanks,
Jeremy Begg
32 REPLIES 32
Steven Schweda
Honored Contributor

Re: A tool to delete all Pathworks ACEs ?

No bets, but Zip+UnZip might strip off the
ACEs without doing too much damage. UnZip
(6.0) has a "-X" option to tell it to restore
ACLs. The default is not to do it. You may
lose the ownership UIC, too, however. As the
"-h" help says:

-X restore owner/ACL protection info

Testing could be educational.
Steven Schweda
Honored Contributor

Re: A tool to delete all Pathworks ACEs ?

BACKUP /INTERCHANGE?

HELP BACKUP /INTERCHANGE says:

o Access control lists are not copied.
Thomas Ritter
Respected Contributor

Re: A tool to delete all Pathworks ACEs ?

$ SET SECURITY/ACL=(ace)/DELETE

doesn't work because the Pathworks ACEs are too long for DCL's command buffer.

Longer than 4096 bytes ? Are you using extended DCL ?
Jeremy Begg
Trusted Contributor

Re: A tool to delete all Pathworks ACEs ?

Hi Steven,

Thanks for the suggestions but neither is suitable -- I need to delete the Pathworks ACEs but not any of the other ACEs on the files, and preferably without changing the file ownership or UIC-based protection, either.

Regards,
Jeremy Begg
Jon Pinkley
Honored Contributor

Re: A tool to delete all Pathworks ACEs ?

Jeremy,

When you say the DCL buffer is too small, is that true if you split the command across several continuation lines (i.e. with "-" at the end of the line)?

Can you show use what a pathworks ACL looks like? I.e. the output of

$ directory/security pathworks_file

If it is ok to delete all the whole ACL, instead of just the pathworks related ACEs, then the following should work.

$ set secruity/acl/delete

If there are other ACEs you don't want to delete, than that won't be a good solution.

Or if all the "extra" ACEs are the same, then a combination of a default ACE on the destination directory, and backup/interchange will work (as suggested by Steven Schweda). That strips the ACL from the source file and applies any default ACEs from the destination directory, and had the "advantage" of not modifying the creation or modification dates on the files, where set security will update the modification date, and I am not aware of any way to avoid it if set security is used.

The ultimate solution is to write a program, but I think you were trying to avoid that.

Jon
it depends
Jon Pinkley
Honored Contributor

Re: A tool to delete all Pathworks ACEs ?

Jeremy,

I didn't see your response before I sent mine. So it doesn't seem that my suggestions will work, especially if the files contain ACEs that can't be applied with default ACEs on the target directory.

BTW, backup/interchange can be used with /owner=original, so it doesn't imply that the ownership of the files will have to change.

Jon
it depends
Jeremy Begg
Trusted Contributor

Re: A tool to delete all Pathworks ACEs ?

Here is the file ...

D2:[web_advertising]Marketing^_Calendar^_WEB^_ADVERT.xls;1 object of class FILE
Owner: [305,12]
Protection: (System: RWD, Owner: RWD, Group, World)
Access Control List:
(UNKNOWN=%X86,SIZE=%D208,FLAGS=%X0400,ACCESS=%X06900000,DATA=%X00000001,%X000000BC,%X000000BC,%X80140001,%X00000084,
%X000000A0,%X00000000,%X00000014,%X00700002,%X00000004,%X00180000,%X001F01FF,%X00000201,%X05000000,%X00000020,%X00000220,
%X00180000,%X001301BF,%X00000201,%X05000000,%X00000020,%X00000225,%X00240000,%X001F01FF,%X00000501,%X05000000,%X00000015,
%X81001D39,%X433F040C,%X317C0A05,%X00000427,%X00140000,%X001301BF,%X00000101,%X01000000,%X00000000,%X00000501,%X05000000,
%X00000015,%X81001D39,%X433F040C,%X317C0A05,%X00000427,%X00000501,%X05000000,%X00000015,%X81001D39,%X433F040C,%X317C0A05,
%X00000201)
(UNKNOWN=%X80,SIZE=%D46,FLAGS=%X0C00,ACCESS=%X06900000,DATA=%X00000008,%X00000001,%X0000041E,%X00000120,%X00000000,
%X00000000,%X38C50000,%X38C5892E,%X38C5892E,%X00008930)
(IDENTIFIER=[USER1],ACCESS=READ+WRITE+EXECUTE+DELETE)
(IDENTIFIER=[305,12],ACCESS=READ+WRITE+EXECUTE+DELETE)
(IDENTIFIER=WEB_AD_USER,ACCESS=READ)
(IDENTIFIER=PRICES_DEPT_USER,ACCESS=READ)
(IDENTIFIER=STUDIO_USER,ACCESS=READ)
(IDENTIFIER=ADMIN_USER,ACCESS=READ+WRITE+EXECUTE+DELETE+CONTROL)
(IDENTIFIER=WEB_AD_RW,ACCESS=READ+WRITE+EXECUTE+DELETE+CONTROL)

And here is a little command procedure I prepared to delete the Pathworks ACEs:

$ set security D2:[web_advertising]Marketing^_Calendar^_WEB^_ADVERT.xls;1/acl=(-
(UNKNOWN=%X86,SIZE=%D208,FLAGS=%X0400,ACCESS=%X06900000,DATA=%X00000001,%X000000BC,%X000000BC,%X80140001,%X00000084,-
%X000000A0,%X00000000,%X00000014,%X00700002,%X00000004,%X00180000,%X001F01FF,%X00000201,%X05000000,%X00000020,%X00000220,-
%X00180000,%X001301BF,%X00000201,%X05000000,%X00000020,%X00000225,%X00240000,%X001F01FF,%X00000501,%X05000000,%X00000015,-
%X81001D39,%X433F040C,%X317C0A05,%X00000427,%X00140000,%X001301BF,%X00000101,%X01000000,%X00000000,%X00000501,%X05000000,-
%X00000015,%X81001D39,%X433F040C,%X317C0A05,%X00000427,%X00000501,%X05000000,%X00000015,%X81001D39,%X433F040C,%X317C0A05,-
%X00000201),-
(UNKNOWN=%X80,SIZE=%D46,FLAGS=%X0C00,ACCESS=%X06900000,DATA=%X00000008,%X00000001,%X0000041E,%X00000120,%X00000000,-
%X00000000,%X38C50000,%X38C5892E,%X38C5892E,%X00008930))/delete
$ show security D2:[web_advertising]Marketing^_Calendar^_WEB^_ADVERT.xls;1
$ exit

But DCL can't cope:

@x.com
%DCL-W-TKNOVF, command element is too long - shorten
\(UNKNOWN=%X86,SIZE=%D208,FLAGS=%X0400,ACCESS=%X06900000,DATA=%X00000001,%X000000BC,%X000000BC,%X80140001,%X00000084,%X000000A0,%X0
0000000,%X00000014,%X00700002,%X00000004,%X00180000,%X001F01FF,%X00000201,%X05000000,%X00000020,%X00000220,%X00180000,%X001
$

Regards,
Jeremy Begg
Jon Pinkley
Honored Contributor

Re: A tool to delete all Pathworks ACEs ?

Jeremy,

Google found this:

http://h71000.www7.hp.com/doc/82final/6543/6543pro_010.html#deleteace

see if that will do what you want.

Jon
it depends
Thomas Ritter
Respected Contributor

Re: A tool to delete all Pathworks ACEs ?

Jeremy, your command line is less than 700 characters.

With extended DCL, the length of the command line increases from 255 characters to 4096. Using hyphens the command may be extended up
to 8192 characters.

I dont have a box available now, but by enabling extended DCL your procedure may work. Under 8.2+ this can be done at the process level.
Look at help dcl or something like that.