[Digital logo]
[HR]

OpenVMS DCL Dictionary


Previous | Contents

In order to modify a security profile, you need control access to the object. An ACL grants control access explicitly whereas a protection code grants it implicitly to anyone belonging to the owner or system categories. If an object profile is modified while the object is being accessed, the existing access is unaffected.

The following table identifies object classes and the access types they support.
Object Class Access Types
CAPABILITY (VAX only) Use, Control
COMMON_EVENT_FLAG_CLUSTER Associate, Delete, Control
DEVICE Read, Write, Physical, Logical, Control
FILE (including directory file) Read, Write, Execute, Delete, Control
GROUP_GLOBAL_SECTION Read, Write, Execute, Control
LOGICAL_NAME_TABLE Read, Write, Create, Delete, Control
QUEUE Read, Submit, Manage, Delete, Control
RESOURCE_DOMAIN Read, Write, Lock, Control
SECURITY_CLASS Read, Write, Control, Logical I/O, Physical I/O
SYSTEM_GLOBAL_SECTION Read, Write, Execute, Control
VOLUME Read, Write, Create, Delete, Control

The OpenVMS Guide to System Security provides a full explanation of protected objects and how to modify them.

Table DCLII-22 shows the qualifier categories for the SET SECURITY command. The explanations for the qualifiers following Table DCLII-22 occur in alphabetical order.

Table DCLII-22 SET SECURITY Qualifier Categories
General
Qualifiers
ACL-Modifying Qualifiers Security Class Qualifier File-Specific Qualifiers Transfer
Qualifiers
/ACL
/CLASS
/LOG
/OWNER
/PROTECTION
/AFTER
/DELETE
/EDIT
/REPLACE
/PROFILE /BACKUP
/BEFORE
/BY_OWNER
/CONFIRM
/CREATED
/DEFAULT
/EXCLUDE
/EXPIRED
/MODIFIED
/SINCE
/COPY_ATTRIBUTE
/LIKE


QUALIFIERS

/ACL[=(ace[,...])]

Identifies one or more access control list entries (ACEs) to add, replace, or delete. Enclose each ACE in parentheses and separate multiple ACEs by commas (,). The most common type of entry, the Identifier ACE, has the format (IDENTIFIER=identifier, ACCESS=access-type(+...)). By default, SET SECURITY adds an ACE to the top of the ACL. This behavior changes when you include one of the positional qualifiers: /AFTER, /DELETE, or /REPLACE. See the discussion of ACL ordering in the OpenVMS Guide to System Security.

/AFTER=ace

Positions all ACEs specified with the /ACL qualifier after the ACE named with the /AFTER qualifier.

/BACKUP

Modifies the time value provided with the /BEFORE or the /SINCE qualifier. The /BACKUP qualifier selects files according to the date of their most recent backup (rather than by the creation, expiration, or modification date). By default, SET SECURITY selects files according to their creation date.

/BEFORE[=time]

Selects only those files dated prior to the specified time. You can specify time as absolute time, as a combination of absolute and delta times, or as one of the following keywords: BOOT, LOGIN, TODAY (default), TOMORROW, or YESTERDAY. Specify the /CREATED or the /MODIFIED qualifier to indicate the time attribute to be used as the basis for selection. The /CREATED qualifier is the default.

For complete information on specifying time values, see the OpenVMS User's Manual or the topic SPECIFY Date_Time in online help.

/BY_OWNER[=uic]

Selects files whose owner's UIC matches the UIC specified. The default UIC is that of the current process.

/CLASS=class-name

Specifies the class of the object whose profile is to be modified. By default, the command assumes the object class is FILE.

/CONFIRM

Controls whether SET SECURITY prompts for verification before performing the operation. Valid responses are YES, NO, TRUE, and FALSE. Answers are not case sensitive and can be abbreviated to one letter. To stop processing the command at any point, type QUIT or press Ctrl/Z. To cancel the verification procedure but to proceed with the command, type ALL.

/COPY_ATTRIBUTE=(keyword[,...])

Specifies a subset of security elements to transfer from a source object to a target object. Valid keywords include the following:
Keyword Description
ALL (default) Copy all security elements
ACL Copy the access control list
OWNER Copy the owner
PROTECTION Copy the protection code

Use the /COPY_ATTRIBUTE qualifier with the /LIKE qualifier. For example, you can create an ACL for an object and then copy its ACL to new objects.

/CREATED

Modifies the time value specified with the /BEFORE or the /SINCE qualifier. The /CREATED qualifier selects files according to the date they were created (rather than by the backup, expiration, or modification date). By default, SET SECURITY selects files according to their creation date.

/DELETE[=ALL]

Deletes ACEs according to the following rules:

/DEFAULT

Regenerates the security profile of a file. The default qualifier changes the protection code, the ACL, and the owner elements of a file to what it would be if the file had just been created. The profile is recreated according to the following rules:

With subdirectory files, SET SECURITY assigns the owner, protection, and ACL elements of the parent directory.

SET SECURITY does not copy any ACE on the source object if the ACE holds the nopropagate attribute nor does it change any ACE on the target object if the ACE holds the protected attribute. To apply new elements to all versions of the file, specify ;* in the object name. Refer to the OpenVMS Guide to System Security for more information on propagation rules.

/EDIT

Invokes the access control list editor (ACL editor) and allows you to modify an ACL interactively. The ACL editor does not allow the asterisk (*) and the percent sign (%) wildcard characters in an object name. You must specify the object whose ACL you are editing.

The /EDIT qualifier must be the first qualifier on the command line; other qualifiers can include /CLASS and, if the class is SECURITY_CLASS, you can include the /PROFILE qualifier. Whenever an object does not belong to the FILE class, you also need to specify /CLASS.

See the ACL editor in the OpenVMS System Management Utilities Reference Manual for more information.

/EXCLUDE=(filespec[,...])

Excludes the specified files from the SET SECURITY operation. You can include a directory, but not a device, in the file specification. You cannot use relative version numbers to exclude a specific version.

/EXPIRED

Modifies the time specified with the /BEFORE or the /SINCE qualifier. The /EXPIRED qualifier selects files according to their expiration dates rather than by the backup, creation, or modification date. (The expiration date is set with the SET FILE/EXPIRATION_DATE command.) By default, files are selected according to their creation date.

/LIKE=(NAME=source-object-name
[,CLASS=source-object-class] [,PROFILE=TEMPLATE=template-name])

Identifies the object from which SET SECURITY should copy security elements. The /LIKE qualifier replaces an object's existing elements with those of the source object. Nopropagate ACEs are not transferred and protected ACEs on the target object are not deleted. Use the /COPY_ATTRIBUTE qualifier with the /LIKE qualifier to copy an object's elements. Refer to the OpenVMS Guide to System Security for information about the special handling of protected and nopropagate ACEs.

The object class of the source object defaults to the class of the target object. When the /CLASS qualifier is omitted, the CLASS keyword defaults to FILE.

The PROFILE keyword applies to security class objects. It identifies which template of the security class you want to copy and modify. See /PROFILE for more information.

/LOG

Controls whether the SET SECURITY command displays the name of the object that has been modified by the command. The qualifier is invalid with the /EDIT qualifier.

/MODIFIED

Modifies the time value specified with the /BEFORE or the /SINCE qualifier. The /MODIFIED qualifier selects files according to the dates on which they were last modified, rather than by the backup, creation, or expiration date. By default, files are selected according to their creation date.

/OWNER=identifier

Modifies the owner element of an object. Specify the user identification code (UIC) or general identifier in the standard format. Modifying the owner element of a file usually requires privileges. See the discussion in the OpenVMS Guide to System Security.

/PROFILE=TEMPLATE[=template-name]

Identifies which template profile of a security class object you want to modify. All object classes except FILE have at least one template profile. These template profiles define the basis of the profile of new objects. Use the DCL command SHOW SECURITY/CLASS=SECURITY_CLASS to display template names. When no value is given for template-name, SET SECURITY uses the template named DEFAULT.

Include the /CLASS=SECURITY_CLASS qualifier to identify which profile you want to modify.

/PROTECTION=(ownership[:access][,...])

Modifies the protection code of an object. The protection code defines the type of access allowed to users, based on their relationship to the object's owner.

Specify the ownership parameter as system (S), owner (O), group (G), or world (W).

Access types are class specific and are shown in the Description section. For access, use the first letter of the access name. The Examples section provides you with models of protection codes.

/REPLACE=(ace[,...])

Eliminates entries listed with the /ACL qualifier and adds entries listed with the /REPLACE qualifier. SET SECURITY inserts the entries listed with /REPLACE in the position of the last deleted ACE.

/SINCE[=time]

Selects only those files dated after the specified time. You can specify time as absolute time, as a combination of absolute and delta times, or as one of the following keywords: BOOT, LOGIN, TODAY (default), TOMORROW, or YESTERDAY. Specify the /CREATED or the /MODIFIED qualifier to indicate the time attribute to be used as the basis for selection. The /CREATED qualifier is the default.

For complete information on specifying time values, see the OpenVMS User's Manual or the topic SPECIFY Date_Time in online help.


Examples

#1
$  SHOW SECURITY LNM$GROUP /CLASS=LOGICAL_NAME_TABLE
LNM$GROUP object of class LOGICAL_NAME_TABLE
     Owner: [SYSTEM]
     Protection: (System: RWCD, Owner: R, Group: R, World: R)
     Access Control List:
          (IDENTIFIER=[USER,SMITH],ACCESS=CONTROL)
$  SET SECURITY LNM$GROUP /CLASS=LOGICAL_NAME_TABLE -
_$      /ACL=((IDENTIFIER=CHEKOV,ACCESS=CONTROL), -
_$            (IDENTIFIER=WU,ACCESS=READ+WRITE)) -
_$       /DELETE=ALL -
_$       /PROTECTION=(S:RWCD, O:RWCD, G:R, W:R)
$  SHOW SECURITY LNM$GROUP /CLASS=LOGICAL_NAME_TABLE
LNM$GROUP object of class LOGICAL_NAME_TABLE
     Owner: [SYSTEM]
     Protection: (System: RWCD, Owner: RWCD, Group: R, World: R)
     Access Control List:
          (IDENTIFIER=[USER,CHEKOV],ACCESS=CONTROL)
          (IDENTIFIER=[USER,WU],ACCESS=READ+WRITE)
 

This example shows how to make a straightforward change to the security elements of an object. The first SHOW SECURITY command displays the current settings of the LNM$GROUP logical name table. The SET SECURITY command resets the ACL to allow control access for user Chekov, and to allow read and write access for user Wu. Note that without the /DELETE=ALL qualifier, these ACEs would have been added to the existing ACL rather than superseding it. The protection is also changed to allow read, write, create, and delete access for the owner. The last command displays the results of the changes.

#2
$  SHOW SECURITY LNM$GROUP /CLASS=LOGICAL_NAME_TABLE
LNM$GROUP object of class LOGICAL_NAME_TABLE
     Owner: [SYSTEM]
     Protection: (System: RWCD, Owner: R, Group: R, World: R)
     Access Control List:
          (IDENTIFIER=[USER,FERNANDEZ],ACCESS=CONTROL)
$  SHOW SECURITY LNM$JOB /CLASS=LOGICAL_NAME_TABLE
LNM$JOB object of class LOGICAL_NAME_TABLE
     Owner: [USER,WEISS]
     Protection: (System: RWCD, Owner: RWCD, Group, World)
     Access Control List:  <empty>
$  SET SECURITY LNM$JOB /CLASS=LOGICAL_NAME_TABLE -
_$      /LIKE=(NAME=LNM$GROUP, CLASS=LOGICAL_NAME_TABLE) -
_$      /COPY_ATTRIBUTES=PROTECTION
$  SET SECURITY LNM$JOB /CLASS=LOGICAL_NAME_TABLE -
_$      /ACL=(IDENTIFIER=FERNANDEZ, ACCESS=READ)
$  SHOW SECURITY LNM$JOB /CLASS=LOGICAL_NAME_TABLE
LNM$JOB object of class LOGICAL_NAME_TABLE
     Owner: [USER,WEISS]
     Protection: (System: RWCD, Owner: R, Group: R, World: R)
     Access Control List:
          (IDENTIFIER=[USER,FERNANDEZ],ACCESS=READ)
 

This example shows how to copy security access information from one object to another and, at the same time, set some elements explicitly. The first SHOW SECURITY commands display the current settings for the LNM$GROUP and LNM$JOB logical name tables. The SET SECURITY command copies the protection code from the LNM$GROUP logical name table to the LNM$JOB logical name table and adds an ACE to allow read access to another user. The final SHOW SECURITY command shows the effect of the changes.

#3
$  SHOW SECURITY SECURITY_CLASS /CLASS=SECURITY_CLASS
SECURITY_CLASS object of class SECURITY_CLASS
     Owner: [SYSTEM]
     Protection: (System: RWED, Owner: RWED, Group: R, World: R)
     Access Control List:  <empty>
  Template: DEFAULT
     Owner: [SYSTEM]
     Protection: (System: RWED, Owner: RWED, Group, World: RE)
     Access Control List:   <empty>
$  SET SECURITY SECURITY_CLASS /CLASS=SECURITY_CLASS -
_$      /PROFILE=TEMPLATE=DEFAULT -
_$      /PROTECTION=(S:RWE, O:RWE, G:RE)
$  SHOW SECURITY SECURITY_CLASS /CLASS=SECURITY_CLASS
SECURITY_CLASS object of class SECURITY_CLASS
     Owner: [SYSTEM]
     Protection: (System: RWED, Owner: RWED, Group: R, World: R)
     Access Control List:  <empty>
  Template: DEFAULT
     Owner: [SYSTEM]
     Protection: (System: RWE, Owner: RWE, Group: RE, World: RE)
     Access Control List:  <empty>
 

This example demonstrates how to change the security elements for the template of a security class object. The first command shows the current settings for the SECURITY_CLASS object. The second command changes the DEFAULT template of the SECURITY_CLASS object such that the protection is (S:RWE, O:RWE, G:RE). The change is shown in the display of the last command. The world protection of RE remains unchanged.


SET SERVER

Controls starting, stopping, and restarting of the security server. The security server maintains information stored in the system intrusion and proxy databases.

Format

SET SERVER server-name


PARAMETER

server-name

The server-name must be SECURITY_SERVER.

DESCRIPTION

The SET SERVER command provides a system manager with a means to start, stop, and restart the security server. The security server maintains information stored in the system intrusion and proxy databases.

The system intrusion database is used by LOGINOUT, DECnet/OSI, DECwindows, SHOW INTRUSION, DELETE INTRUSION, and other applications. For more information about the system intrusion database and $DELETE_INTRUSION, $SCAN_INTRUSION, and $SHOW_INTRUSION system services, see the OpenVMS System Services Reference Manual. For further information, see the OpenVMS Guide to System Security.

The system proxy database is used by AUTHORIZE, DECnet/OSI, DFS, and other applications to access information stored in the nework proxy database. Additional information can be found in the OpenVMS System Management Utilities Reference Manual. See also the $ADD_PROXY, $DELETE_PROXY, $DISPLAY_PROXY, $VERIFY_PROXY system services in the OpenVMS System Services Reference Manual.


QUALIFIERS

/EXIT

Stop the detached security server process.

/RESTART

Restart the detached security server process.

/START

Start the detached security server process.


Examples

#1
$ SET SERVER SECURITY_SERVER/START    

This command starts the detached security server process.

#2
$ SET SERVER SECURITY_SERVER/EXIT

This command stops the detached security server process.

#3
$ SET SERVER SECURITY_SERVER/RESTART

This command restarts the detached security server process.


SET SYMBOL

Controls access to local and global symbols in command procedures.

Format

SET SYMBOL


DESCRIPTION

The SET SYMBOL command controls access to local and global symbols in command procedures by treating symbols as undefined. Because all global and local symbols defined in an outer procedure level are accessible to inner procedure levels, it is often necessary to mask these symbols without deleting them.

The SET SYMBOL command also controls whether DCL will attempt to translate the verb string (the first token on the command line) as a symbol before processing the line. The default behavior is that the translation is attempted. The advantage to changing this behavior is that a command procedure will not be affected by outer procedure level environments when invoking a command.

The symbol scoping context is different for local and global symbols. Local symbols are procedure level dependent. Local symbols defined in an outer subroutine level can be read at any inner subroutine level, but they cannot be written to. If you assign a value to a symbol that is local to an outer subroutine level, a new symbol is created at the current subroutine level. However, the symbol in the outer procedure level is not modified.

This means that the SET SYMBOL/SCOPE=NOLOCAL command causes all local symbols defined at an outer procedure level to be inaccessible to the current procedure level and any inner levels. For example, if SET SYMBOL/SCOPE=NOLOCAL was specified at procedure levels 2 and 4, procedure level 2 can read (but not write to) only level 2 local symbols. Level 3 can read (but not write to) level 2 local symbols and can read and write to level 3 local symbols. Level 4 can read and write to only level 4 local symbols.

Global symbols are procedure-level independent. The current global symbol scoping context is applied subsequently to all procedure levels. Specifying the /SCOPE=NOGLOBAL qualifier causes all global symbols to become inaccessible for all subsequent commands until either the /SCOPE=GLOBAL qualifier is specified or the procedure exits to a previous level at which global symbols were accessible. In addition, specifying the /SCOPE=NOGLOBAL qualifier prevents you from creating any new global symbols until the /SCOPE=GLOBAL qualifier is specified.

When you exit a procedure level to return to a previous procedure, the symbol scoping context from the previous level is restored for both local and global symbols.

To display the current symbol scoping state, use the lexical function F$ENVIRONMENT("SYMBOL_SCOPE").


QUALIFIERS

/ALL (default)

Specifies that the values of the /SCOPE qualifier pertain both to the translation of the first token on a command line and to general symbol substitution.

The /ALL qualifier is incompatible with the /GENERAL or the /VERB qualifier.

/GENERAL

Specifies that the values of the /SCOPE qualifier pertain to the translation of all symbols except the first token on a command line.

The /GENERAL qualifier is incompatible with the /ALL or the /VERB qualifier.

/SCOPE=(keyword,...)

Controls access to local and global symbols. Lets you treat symbols as being undefined. Possible keywords are as follows:
NOLOCAL Causes all local symbols defined in outer procedure levels to be treated as being undefined by the current procedure and by all inner procedure levels.
LOCAL Removes any symbol translation limit set by the current procedure level.
NOGLOBAL Causes all global symbols to be inaccessible to the current procedure level and to all inner procedure levels unless otherwise changed.
GLOBAL Restores access to all global symbols.

/VERB

Specifies that the values of the /SCOPE qualifier pertain to the translation of the first token on a command line as a symbol before processing only. It does not affect general symbol substitution.

Note

Caution must be used if the SET SYMBOL/VERB/SCOPE command is used more than once in a command procedure. Because DCL uses the translation behavior when looking for a label or subroutine, execution may be different running in one mode than in another. Digital recommends that the SET SYMBOL/VERB/SCOPE command be used once as part of the command procedure setup and left in that mode for the duration of the procedure.

The /VERB qualifier is incompatible with the /ALL or the /GENERAL qualifier.


Examples

#1
$ SET SYMBOL/SCOPE=NOLOCAL

In this example, all local symbols defined in outer procedure levels are now undefined for the current procedure level and all inner procedure levels.

#2
$ SET SYMBOL/SCOPE=NOGLOBAL

In this example, all global symbols are now inaccessible to the current procedure level and all inner procedure levels unless otherwise changed.

#3
$ NOW :== SHOW TIME
$ !
$ NOW
   7-APR-1994 11:48:58
$ !
$ SET SYMBOL /VERB /SCOPE=NOGLOBAL
$ NOW
%DCL-W-IVVERB, unrecognized command verb-check validity and spelling
 \NOW\
$ !
$ SHOW SYMBOL NOW
  NOW == "SHOW TIME"

This example demonstrates the use of the /VERB qualifier.

The symbol NOW is assigned to the SHOW TIME command. The next line shows the default behavior, where DCL attempts to translate the first string on the command line (NOW). Since NOW translates to the SHOW TIME command, this is used instead of NOW.

The SET SYMBOL command on the next line changes the behavior so that DCL does not attempt a translation. When NOW is subsequently entered, DCL uses the string NOW as the command verb and cannot find it in the command table. This results in the error message.

Notice that the scoping of the verb translation has no effect on general symbol translations, as demonstrated by the SHOW SYMBOL command in the example.


SET TERMINAL

Sets the characteristics of a terminal. Entering a qualifier changes a characteristic; omitting a qualifier leaves the characteristic unchanged.

Format

SET TERMINAL [device-name[:]]


PARAMETER

device-name[:]

Specifies the device name of the terminal. The default is SYS$COMMAND if that device is a terminal. If the device is not a terminal, an error message is displayed.

DESCRIPTION

The SET TERMINAL command modifies specific terminal characteristics for a particular application or overrides system default characteristics. (These defaults are defined at each installation, based on the most common type of terminal in use.) The default characteristics for terminals are listed in Figure DCLII-2.

The terminal characteristics, local or remote, are determined automatically by the terminal driver for terminals that have the modem characteristic enabled. These characteristics are not affected by the SET TERMINAL command. For example, when you successfully dial in to an OpenVMS system processor, you establish your terminal as remote. When you hang up, the terminal characteristic is set back to local.

The set of terminals supported by the OpenVMS system includes a set of VT100 family terminals that support special Digital ANSI characteristics and escape sequences. For a description of these special characteristics and escape sequences, see the OpenVMS Wide Area Network I/O User's Reference Manual.

Figure DCLII-2 Default Characteristics for Terminals





QUALIFIERS

/ADVANCED_VIDEO

/NOADVANCED_VIDEO

Controls whether the terminal has advanced video attributes and is capable of 132-column video. If the terminal width is set to 132 columns and you specify the /ADVANCED_VIDEO qualifier, the terminal page limit is set to 24 lines. If you specify the /NOADVANCED_VIDEO qualifier, the terminal page limit is set to 14 lines.

/ALTYPEAHD

Causes the terminal driver to create a permanent, alternate type-ahead buffer. The system parameter TTY_ALTYPAHD determines the size of the type-ahead buffer. This specification is effective at your next login and stays in effect until you reboot your VAX computer.

To enable /ALTYPEAHD, you must also set the qualifier /TYPE_AHEAD.

You should specify SETTERMINAL/PERMANENT/ALTYPEAHD in SYS$STARTUP:SYSTARTUP_VMS.COM for those communication lines that require this capability.

To use this feature interactively, specify SET TERMINAL/PERMANENT/ALTYPEAHD. This specification is effective at your next login.

/ANSI_CRT (default)

/NOANSI_CRT

Controls whether the terminal conforms to ANSI CRT programming standards. Since ANSI standards are a proper subset of the DEC_CRT characteristics, the default for all VT100 family terminals is /ANSI_CRT.

/APPLICATION_KEYPAD

Specifies that the keypad is to be set to application keypad mode, which allows you to enter DCL commands defined with the DEFINE/KEY command. By default, the terminal is set to numeric keypad mode.

/AUTOBAUD

/NOAUTOBAUD

Controls whether the terminal baud rate is set when you log in and sets the default terminal speed to 9600. You must press the Return key two or more times at intervals of at least 1 second for the baud rate to be determined correctly. If you press a key other than the Return key, the /AUTOBAUD qualifier may detect the wrong baud rate. If this happens, wait for the login procedure to time out before continuing. The /AUTOBAUD qualifier must be used with the /PERMANENT qualifier.

The valid baud rates are as follows:

 50       150       1800       4800       38400 
 75       300       2000       7200       57600 
110       600       2400       9600       76800 
134      1200       3600      19200      115200 

/BLOCK_MODE

/NOBLOCK_MODE

Controls whether block mode transmission, local editing, and field protection are performed.

/BRDCSTMBX

/NOBRDCSTMBX

Controls whether broadcast messages are sent to an associated mailbox if one exists.

/BROADCAST (default)

/NOBROADCAST

Controls whether reception of broadcast messages (such as those issued by MAIL and REPLY) is enabled. Specify the /NOBROADCAST qualifier when you are using a terminal as a noninteractive device or when you do not want special output to be interrupted by messages. Use the SET BROADCAST command to exclude certain types of messages from being broadcast, rather than eliminating all messages.

/COLOR

Sets the ANSI_COLOR terminal characteristic and identifies the terminal as capable of supporting the ANSI color escape sequences.

/COMMSYNC

/NOCOMMSYNC (default)

Allows connection of asynchronous printers and other devices to terminal ports, using standard modem control signals as flow control. Transmission to the device stops if either data set ready (DSR) or clear to send (CTS) EIA modem control signals are dropped. Transmission resumes when both signals are present.


Previous | Next | Contents | [Home] | [Comments] | [Ordering info] | [Help]

[HR]

  9996P049.HTM
  OSSG Documentation
  26-NOV-1996 11:18:18.08

Copyright © Digital Equipment Corporation 1996. All Rights Reserved.

Legal