UACC Class
Each record in the UACC class defines the default access allowed to a resource class. The UACC record also determines the access level allowed to a resource of that class that is not protected by .
capamsc141
Each record in the UACC class defines the default access allowed to a resource class. The UACC record also determines the access level allowed to a resource of that class that is not protected by
PAM Server Control
.UACC is applicable to most, but not all, classes. The following table shows how each class uses the UACC class.
UACC Usage | Class |
Standard | ADMIN, APPL, AUTHHOST, CALENDAR, CONNECT, CONTAINER, DOMAIN, GAPPL, GAUTHHOST, GHOST, GSUDO, GTERMINAL, HOLIDAY, HOST, HOSTNET, HOSTNP, MFTERMINAL, POLICY, PROCESS, PROGRAM, REGKEY, REGVAL, RULESET, SUDO, SURROGATE, TCP, TERMINAL, USER_DIR, User Defined Classes |
Nonstandard | FILE, GFILE |
None | AGENT, AGENT_TYPE, CATEGORY, GROUP, PWPOLICY, RESOURCE_DESC, RESPONSE_TAB, SECFILE, SECLABEL, SEOS, SPECIALPGM, USER, USER_ATTR |
For users outside the special _restricted group, the record for FILE in the UACC class protects only files that are part of
PAM Server Control
. Examples: the seos.ini, seosd.trace, seos.audit, and seos.error files. These files are not explicitly defined to PAM Server Control
, but are automatically protected by PAM Server Control
.The key of the UACC class record is the name of the class whose UACC properties are being defined.
The following definitions describe the properties contained in this class record. Most properties are modifiable and can be manipulated using selang or the administration interfaces. Non-modifiable properties are marked
informational
.- ACLDefines a list of accessors (users and groups) permitted to access the resource, and the accessors' access types.Each element in the access control list (ACL) contains the following information:
- AccessorDefines an accessor.
- AccessDefines the access authority that the accessor has to the resource.
- ALLOWACCSA list of all allowed accesses for this class.
- RAUDITDefines the types of access events thatPAM Server Controlrecords in the audit log. RAUDIT derives its name fromResourceAUDIT. Valid values are:
- allAll access requests.
- successGranted access requests.
- failureDenied access requests (default).
- noneNo access requests.
PAM Server Controlrecords events on each attempted access to a resource, and does not record whether the access rules were applied directly to the resource, or were applied to a group or class that had the resource as a member.Use the audit parameter of the chres and chfile commands to modify the audit mode. - COMMENTDefines additional information that you want to include in the record.PAM Server Controldoes not use this information for authorization.Limit:255 characters.
- CREATE_TIME(Informational) Displays the date and time when the record was created.
- NACL
The
NACL
property of a resource is an access control list that defines the accessors that are denied authorization to a resource, together with the type of access that they are denied (for example, write). See also ACL, CALACL, PACL. Each entry in the NACL contains the following information:- Accessor
Defines an accessor.
- AccessDefines the type of access that is denied to the accessor.
Use the authorize deniedaccess command, or the authorize- deniedaccess- command, to modify this property.
- OWNER
Defines the user or group that owns the record.
- UACC
Defines the default access authority for the resource, which indicates the access granted to accessors who are not defined to
PAM Server Control
or who do not appear in the ACL of the resource.Use the defaccess parameter with the chres, editres, or newres command to modify this property.
- UPDATE_TIME
(Informational) Displays the date and time when the record was last modified.
- UPDATE_WHO
(Informational) Displays the administrator who performed the update.