A tool to delete all Pathworks ACEs ?

[Jeremy Begg]

Nice suggestion but unfortunately no good as that program is part of the Advanced Server kit -- and therefore has not been made available on Integrity.

However I have a call open to HP about this one and will request they build it for Integrity.

Thanks,
Jeremy Begg

[David Jones_21]

Attached is the C source for the program I used.

[Jeremy Begg]

Hi David,

Looks promising, but it needs another file "modrevdate.h" to build.

Thanks,
Jeremy Begg

[Thomas Ritter]

Maybe $ SET PROCESS/PARSE_STYLE=extended

[Jon Pinkley]

Thomas,

I may be wrong, but I still think there is 255 character limit on each DCL token.

This is on Alpha OpenVMS V8.3

$ help/mess TKNOVF


TKNOVF, command element is too long - shorten

Facility: CLI, Command Language Interpreter (DCL)

Explanation: An element (that is, any string placed between two delimiters)
in the command line exceeds the maximum length of 255 bytes.

User Action: Correct and reenter the command.


David's program is the way to go, once he provides the modrevdate.h file.

Jon

[Jeremy Begg]

Well, I found the magic incantation to expand DCL's command line buffer.

$ HELP SET PROCESS/TOKEN

tells you all about it. (I couldn't find this in any of the VMS 8.x "New Features" or "Release Notes" documentation.)

Unfortunately it still didn't work ...

%SET-E-NOHIDDEN, cannot modify hidden ACEs

Those Pathworks engineers clearly didn't want you messing with their security! :-)

Regards,
Jeremy Begg

[Jon Pinkley]

Jeremy,

If you don't care if the modification date is changed, you can probably remove #include and references to the functions that must be provided in modrevdate.h; save_revdate, format_revdate and restore_revdate. I removed the #include modrevdate.h and compiled, and these popped out.

Unless you are in a big hurry, I would wait for David to provide modrevdate.h, unless you really want the revision dates to be updated.

My guess is that you have a much higher probability of getting a response from David before you get an IA64 version of PWRK$DELETEACE.EXE. And David's program has the added benefit of being able to tweak the program to your specific needs.

Otherwise, you could parse the output of directory file, and generate the SET SECURITY command to delete the ACL, and recreate the non-pathworks ones.

From help set security/delete

o The expression /ACL=aces/DELETE=ALL deletes the existing ACL (if any) and create a new ACL with the ACEs specifies on the /ACL qualifier.

Note that "solution" will not be any better than David's program with all the revision date preservation code removed, and it would probably be a lot easier to modify David's code than to write DCL to parse and recreate the correct set security commands needed to delete and recreated the ACL after turning on extended DCL tokens.

Just my opinion,

Jon

[Jan van den Ende]

Jeremy,

this is from my rusting bio-memory, and from way back when, but

>>>
Unfortunately it still didn't work ...

%SET-E-NOHIDDEN, cannot modify hidden ACEs
<<<

ISTR that the BYPASS privilege (ooch!) could overcome that.

IF my memory serves me (and you) well...

At least worth a try.

fwiw

Proost.

Have one om me.

jpe

[David Jones_21]

Sorry about that. I wrote it in 2005 when we dropped pathworks and started using Samba.

I light of information on the HP support site, you might want to fixup the is_pathworks_ace() function to more accurately discern the ACEs to eliminate.

[David Jones_21 · Accepted solution]

Dangit, brain fog this morning. This attachment actually has all the files you need.