Download HP DECset for OpenVMS Guide to the Code Management System

Security Features
7.2 CMS ACLs
INSERT_ELEMENT
(IDENTIFIER=[WORK,JONES],ACCESS=EXECUTE+CONTROL)
$ CMS INSERT ELEMENT ELEMENT.2 GROUP2 ""
%CMS-S-INSERTED, element DISKX:[PROJECT.CMSLIB]ELEMENT.2 inserted into
group DISKX:[PROJECT.CMSLIB]GROUP2
In this example, user JONES assigns an ACL containing CONTROL access
to the INSERT ELEMENT command. The SHOW ACL command displays
the ACL on INSERT ELEMENT. (Note that commands containing more
than one word must be specified with an underscore.) The example then
shows that JONES tries to insert another element into another group.
The attempt fails because, although JONES has CONTROL access to the
INSERT ELEMENT command, he does not also have EXECUTE access to
it.
CONTROL access allows you to modify the ACL. Because JONES has
CONTROL access, he modifies the ACL to allow himself EXECUTE access
to the INSERT ELEMENT command. (You must have EXECUTE access to
use any commands.) He can then insert elements successfully.
3.
$ CMS SET LIBRARY [WORK.CMSLIB],[PROJECT.CMSLIB]
%CMS-I-LIBIS, library is DISKX:[WORK.CMSLIB]
%CMS-I-LIBINSLIS, library DISKX:[PROJECT.CMSLIB] inserted at end of
library list
%CMS-S-LIBSET, library set
$ CMS SET ACL/ACL=((IDENTIFIER=SMITH,ACCESS=CONTROL),(IDENTIFIER=*, _$ ACCESS=NONE))DELETE_ELEMENT/OBJECT_TYPE=COMMAND/OCCLUDE=NOOTHER ""
%CMS-S-MODACL, modified access control list for command
DISKX:[WORK.CMSLIB]DELETE_ELEMENT
%CMS-S-MODACL, modified access control list for command
DISKX:[PROJECT.CMSLIB]DELETE_ELEMENT
%CMS-S-MODACLS, 2 access control lists modified
This example shows the use of occlusion. The SET ACL command is used
to restrict access to the DELETE ELEMENT command in both libraries
[WORK.CMSLIB] and [PROJECT.CMSLIB]. See Section 3.3 for more
information on occlusion.
Security Features 7–17