Letting unprivileged users initialize and mount tape devices

[Allan Poulsen]

Dear All

I have a problem where I have to let otherwise unprivileged users initalize, mount and use tape devices in an OpenVMS 7.3 Alpha Cluster. I know of the privileges MOUNT, OPER and VOLPRO. This however does not let an unprivileged user initialize or mount a system wide tape device. I certantly does not want the user to have SYSPRV for this operation. Do any of you know a way through this problem?

[Karl Rohwedder]

You may set an ACL (SET SECURITY) on the tapedevice to allow specific users access.

regards Kalle

[Steven Schweda]

Or just set the protection if you don't care
who does what. (An ACL lets you be more
selective, of course.) Around here (with me
being the only likely user), for example:

ALP $ show devi /full dlt

Magtape ALP$MKB400:, device type Quantum DLT4000 CPQ DRV, is online, record-
oriented device, file-oriented device,
[...]
Owner process ID 00000000 Dev Prot S:RWPL,O:RWPL,G:R,W:RWPL

[Allan Poulsen]

Thank You Kalle and Steven

I should have thought of that. This clearly shows I still have a lot to learn in the VMS world...

[Robert Gezelter]

Allan,

Please review the details of protecting devices in the OpenVMS Guide to System Security (available from the OpenVMS www site at http://www.hp.com/go/openvms )

It works quite well, also check out the details of using the ALLOCATE command. Private volumes are different from public volumes.

- Bob Gezelter, http://www.rlgsc.com

[John Abbott_2 · Accepted solution]

Some Example to get you started;

(old syntax)
$ set acl/object=device/acl=(ident=[*,*],access=none) 'device'
$ set acl/object=device/acl=(ident=[uic],access=read+write+control) 'device'
(still works under vms v8.2)

(current - check help, can recall from which version of vms...)
$ set security/class=device/acl=(ident=[uic],access=read+write+control) 'device'

Hope this helps.
John.