DCE Permissions Supported by CDS

CDS supports the following DCE permissions: read (r), write (w), insert (i), delete (d), test (t), control (c), and administer (a). Each permission has a slightly different meaning, depending on the kind of CDS name with which it is associated. In general, the permissions are defined as follows:

· Read Permission - Allows a principal to look up a name and view the attribute values that are associated with it.

· Write Permission - Allows a principal to change the modifiable attributes that are associated with a name, except its ACLs.

· Insert Permission - Allows a principal to create new names in a directory (for use with directory entries only).

· Delete Permission - Allows a principal to delete a name from the namespace.

· Test Permission - Allows a principal to test whether an attribute of a name has a particular value without being able to actually see any of the values; that is, without having read permission to the name.

Test permission provides application programs with a more efficient way to verify a CDS attribute value. Rather than reading an entire set of values, an application can test for the presence of a particular value.

· Control Permission - Allows a principal to modify the ACL entries that are associated with a name. (Note that read permission is also necessary for modifying a CDS entry's ACLs; otherwise, dcecp and acl_edit will not be able to bind to the entry.) Control permission is automatically granted to the creator of a CDS entry.

· Administer Permission - Allows a principal to issue CDS commands that control the replication of directories. Administer permission is for use with directory entries only.

A principal needs some permission to a name before it can try to perform management operations on the name. Otherwise, CDS does not recognize the name when the principal tries the management operation and returns an error that the name does not exist. If the principal has some permissions, but not those required to perform the operation, CDS returns an error explaining that the principal had insufficient rights to perform the operation.

The creator of a name is automatically granted all permissions that are appropriate for the type of name that is created. For example, a principal that is creating an object entry is granted read, write, delete, test, and control permissions to the object entry. A principal that is creating a directory is granted read, write, insert, delete, test, control, and administer permissions to the directory.

Note: Unlike the security mechanisms that are enforced by most other file systems, CDS does not require a principal to have access to all intermediate elements in the path name (full name) of a name in order to perform an operation on the name. For example, consider an object entry object1 stored in the /.:/sales directory. In CDS, you can grant a principal access to the object entry /.:/sales/object1 without necessarily granting the principal access to either the /.:/sales directory or the cell root directory (/.:).