ACL_SCRUB for Alpha

[Zeni B. Schleter]

I had found the vax89b2 early on. I fixed the structure but only two of the files were successfully removed from the backup set. The dates were 1989 and the text file matched exactly what I had. Since the title included "VAX" was was not hopeful that there would be Alpha results.

I found a similar Macro statement for compiling the arch_defs.mar with the macro code. Now I am getting "DATINCODE" messages. .long gives a problem.

I searched the ITRC web site for VEST but did not find any hits.

Maybe it will all fall in place tomorrow. I have the MACRO-32 Porting and User's Guide.

[Robert Gezelter · Accepted solution]

Zeni,

My apologies.

VEST is an acronym. The "product" name is/was DECMigrate. Information can be found at http://h71000.www7.hp.com/openvms/products/omsva/omsva.html

- Bob Gezelter, http://www.rlgsc.com

[Robert Gezelter]

Zeni,

For completeness, the acronym VEST stands for VAX Environment Software Translator".

The latest name is "OpenVMS Migration Software for VAX to Alpha" (with the acronym "OMSVA").

- Bob Gezelter, http://www.rlgsc.com

[Jon Pinkley]

While I agree that deleting user accounts and the associated Identifiers has more downsides than upsides, VMS does not normally reuse the same value for a general identifier.

That is, if you issue a commands like

$ mcr authorize show /id testid /ful
%UAF-E-SHOWERR, unable to complete SHOW command
-SYSTEM-F-NOSUCHID, unknown rights identifier
$ mcr authorize add /id testid
%UAF-I-RDBADDMSG, identifier TESTID value %X800100CB added to rights database
$ mcr authorize rem /id testid
%UAF-I-RDBREMMSG, identifier TESTID value %X800100CB removed from rights database
$ mcr authorize add /id testid
%UAF-I-RDBADDMSG, identifier TESTID value %X800100CC added to rights database
$

The "next" value to be assigned to an identifier is kept in the RIGHTSLIST record with key value $$MAINTENANCE_RECORD. AUTHORIZE will attempt to use the value in the last 8 bytes of the $$MAINTENANCE_RECORD, and if that is already in use, it will keep incrementing until if gets to an unused value, and will then update the record with the next highest value.

I am not aware of any way to reset the value other than rewriting the $$MAINTENANCE_RECORD, i.e. it won't happen by accident.

Stock VMS does not remember what UICs have been used, at if it does, I am not aware of where it does. We have a command procedure we use to create new accounts, and each group has a template account, and we store the HEX value of the next UIC in the /owner field, just so we don't reuse UICs.

++++++++++++++++++++++++++++++++++++++++++++

Blue Sky mode on:

I wish each disk had a reserved file like [000000]RIGHTSLIST.SYS that contained the set of identifiers that were used on the disk, and this could be optional like QUOTA.SYS is for people that didn't want it.

Then when a volume was mounted, a consistency check could be done against the current RIGHTSLIST on the system, and if there were conflicts, it could refuse to mount the disk unless something like /override=rightslist_processing was specified. An anal/disk/repair would rebuild the file from the UICs and Identifiers found on the disk and the current RIGHTSLIST.DAT file.

The reason for such a check is to avoid accidentally granting ownership or access to files on the volume.

[Zeni B. Schleter]

I had looked but did not see...
Bob, Thanks for putting me directly on the page with the info and the link for the download. I had found information about Vest/Decmigrate/OMSVA but not specific about licensing or the download link.

Re: about deleting. Sort of too-late for not doing it. I keep info on removed Identifiers and accounts.

[Wim Van den Wyngaert]

I tried to compile it :

.PSECT DATA,RD,WRT,NOEXE in the beginning of .mar file
.PSECT CODE,RD,NOWRT,EXE before entry in .mar file

/stand=vaxc
all char * of cld.h replaced by static char *
and put delete_ace in comment to be safe

replace for by fortran

removed /option from link and added /nonative.

It runs. Displays confusing output like

file Owner_uic = [0,6] = []
for some time, displays some ace's
and aborts on first "if" in display.c.

Did something change between vax and alpha on the subject of indexf.sys ?

Wim

[Zeni B. Schleter]

I will try the OMSVA (migration tool) on a test machine and see what kind of results happen. It may completely rule out the use for ACL_SCRUB software for Alpha hardware.

Thanks to all for the useful discussion.

P.s. Wim, I meant to add 8 points for your follow-up message about the .PSECT but after submitting the points , I saw the result was 1 . Not intentional. Don't know how to fix.

[Jan van den Ende]

eni,

>>>
I meant to add 8 points for your follow-up message about the .PSECT but after submitting the points , I saw the result was 1 . Not intentional. Don't know how to fix.
<<<

Sorry _NO_ way to change submitted points (AFAIK, not even be asking the moderators).
In practice, that means you can NEVER revoke points once given.
In a case like this however, just ask the intended receiver to reply once more, just to give the extra points to the extra answer.

hth

Proost.

Have one on me.

jpe

[Wim Van den Wyngaert]

Sorry to not have solved the problem. I was a programmer once but not a VMS one (cobol VMS/HP3000/Unix). I think the problem is a pointer issue that was forgiven / autocorrected by the VAX compiler.

BTW : could you post the normal output of the program ? I might find it next week.

Wim

[Zeni B. Schleter]

The OMSVA software will work. I have not completely tested it but the resulting image does run and does create the expected output file.

The output can be lengthy if there are a lot of ACEs. Each file and its associated ACEs are noted like:
_DSA0:[SYS2]DNS$SERVER.DIR;1
Identifier ace: (IDENTIFIER=NETWORK,OPTIONS=DEFAULT,ACCESS=NONE)
Identifier ace: (IDENTIFIER=NETWORK,ACCESS=NONE)

Typically, I search the output file for "owner_uic" to find files that are not owned by valid UICs

An example (forgive the Wrap) is >
DSA0:[VMS$COMMON.SYSLIB]LNGSPLSHR.EXE;6 Owner_UIC = [15,1] = []

ACEs for sub-systems are noted but not modified. Audit ACEs are noted as "unknown". ACEs that are for unowned UICs or invalid Identifiers are removed.