Logical Name Table Protection

[Robert Atkinson]

Any idea how I change the protection on this Group Name Table to (G:RW) permanently?

Do I need to put something into SYSECURITY.COM?

(LNM$GROUP_000310) [kernel] [shareable,group]
[Protection=(RWCD,R,R,)] [Owner=[ITDEVMT,*]]

Rob.

[Volker Halle · Accepted solution]

Rob,

putting the commands in SYSECURITY.COM won't help, as this group table would probably not yet exists at startup time.

The group logical name table get created, once the first user in that group logs in.

You might want to submit a batch-job under a user of this group during startup and then set the protection of the group table from a privileged user, once the batch job has finished and the group table has been created.

Volker.

[Robert Atkinson]

Wow, that's pretty nasty.

You're definitely sure that's the only method? I'd check it out, but our test node's in use at the moment.

Rob.

[Ian Miller.]

Minimally the following will result in the group table being created.
$ run/det/inp=nl:/out=nl:/uic=[310,0] sys$system:loginout.exe

You can then the protection using the SET SECURITY command.

[Robert Atkinson]

OK, thanks Ian.

I'll add that to SYSECURITY and see what happens.

Rob.

[Robert Gezelter]

Rob,

There is nothing special about the group logical name table, merely that it be named correctly and entered in the correct place.

This is normally done when the first login from that group occurs, but a simple CREATE can accomplish the same thing during the startup process.

You may also reconsider granting the WRITE permission, and instead consider the use of an ACL with an explicit identifier, or the use of GRPPRV or GRPNAM. Either approach may will produce a higher safety level in many cases.

- Bob Gezelter, http://www.rlgsc.com

[Ian Miller.]

Using CREATE/NAME_TABLE will not create a table which has the same attributes as tables created by a process logging in
i.e. [kernel, no_alias]

(You can get a exec mode table with CREATE) I don't know if this makes any real difference.

Use of an identifier based protection scheme instead of UIC group does does give finer control but what is suitable for your use depends on your requirements.

[Jan van den Ende]

Rob,

>>>
I'll add that to SYSECURITY and see what happens.
<<<

Note that SYLOGICALS is executed even earlier, so, depending on your needs..

I agree with Bob, that ACLs are much more fine-grained, and perhaps better suited.
However, like Ian, I disagree with him on CREATE_TABLE. Creating the first process in a UIC group creates the kernel mode table, with no_alias, which even prevent, or overrules the effects of, a table in any non-kernel mode.

btw, what is so "pretty nasty" about creating a table before being able to manipulate its protection? To me it sounds more nasty if you could just reference a table, (eg, with SET PROT) and hen that reference would create it.
Process creation is the established VMS method for creating group logical name tables.

just my EUR 0.02

Proost.

Have one on me.

jpe

[Robert Atkinson]

Decided to submit a command from SYSTARTUP