[mod.computers.vax] Secure file access, and the BYPASS priv...

xrjjm%csdr.span@JPL-VLSI.ARPA.UUCP (03/31/87)

Comment:   Begin User Supplied Mail Headers.
*Site:     NASA Goddard Space Flight Center - Greenbelt, Maryland, USA.
*From:     John J. McMahon, Systems Programmer, STX - ST Systems Corporation.
*Project:  COBE Science Data Room (CSDR), Code 401.1
*Reply-To: (Arpa-Internet)       XRJJM%CSDR.SPAN@JPL-VLSI.ARPA
*Reply-To: (Bitnet)              ZMJJM@SCFVM
*Reply-To: (Span/Physnet/Hepnet) 6173::XRJJM = CSDR::XRJJM (Node 6.29)
*Reply-To: (TEXnet)              UTADNX::UTSPAN::CSDR::XRJJM

Well, my first comment would be that BYPASS is not a secure privledge under
any condition...  It allows you to do something, regardless of the protections
set up on a file.

1) How do I prevent people from redefining SYS$SYSTEM ?
. Your routine could either DEASSIGN SYS$SYSTEM at startup, to prevent an
override, or set up your system so that the SYSTEM Logical name table is
checked prior to any users tables (or group tables).

2) How does user A & B access file F as if they were the same user ?
. Place an Access Control List on the file.

Hope this helps!
^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v
John J. McMahon (Fast-Eddie)                     
Disclaimer: Views expressed in this letter are my own, 
            and are not meant to represent the views of my employers.