UACC Class

Each record in the UACC class defines the default access allowed to a resource class. The UACC record also determines the access level allowed to a resource of that class that is not protected by .
capamsc141
Each record in the UACC class defines the default access allowed to a resource class. The UACC record also determines the access level allowed to a resource of that class that is not protected by
PAM Server Control
.
UACC is applicable to most, but not all, classes. The following table shows how each class uses the UACC class.
UACC Usage
Class
Standard
ADMIN, APPL, AUTHHOST, CALENDAR, CONNECT, CONTAINER, DOMAIN, GAPPL, GAUTHHOST, GHOST, GSUDO, GTERMINAL, HOLIDAY, HOST, HOSTNET, HOSTNP, MFTERMINAL, POLICY, PROCESS, PROGRAM, REGKEY, REGVAL, RULESET, SUDO, SURROGATE, TCP, TERMINAL, USER_DIR, User Defined Classes
Nonstandard
FILE, GFILE
None
AGENT, AGENT_TYPE, CATEGORY, GROUP, PWPOLICY, RESOURCE_DESC, RESPONSE_TAB, SECFILE, SECLABEL, SEOS, SPECIALPGM, USER, USER_ATTR
For users outside the special _restricted group, the record for FILE in the UACC class protects only files that are part of
PAM Server Control
.  Examples: the seos.ini, seosd.trace, seos.audit, and seos.error files. These files are not explicitly defined to
PAM Server Control
, but are automatically protected by
PAM Server Control
.
The key of the UACC class record is the name of the class whose UACC properties are being defined.
The following definitions describe the properties contained in this class record. Most properties are modifiable and can be manipulated using selang or the administration interfaces. Non-modifiable properties are marked
informational
.
  • ACL
    Defines a list of accessors (users and groups) permitted to access the resource, and the accessors' access types.
    Each element in the access control list (ACL) contains the following information:
    • Accessor
      Defines an accessor.
    • Access
      Defines the access authority that the accessor has to the resource.
    Use the access parameter with the authorize or authorize- command to modify the ACL.
  • ALLOWACCS
    A list of all allowed accesses for this class.
  • RAUDIT
    Defines the types of access events that 
    PAM Server Control
    records in the audit log. RAUDIT derives its name from
    R
    esource
    AUDIT
    . Valid values are:
    • all
      All access requests.
    • success
      Granted access requests.
    • failure
      Denied access requests (default).
    • none
      No access requests.
    PAM Server Control
     records events on each attempted access to a resource, and does not record whether the access rules were applied directly to the resource, or were applied to a group or class that had the resource as a member.
    Use the audit parameter of the chres and chfile commands to modify the audit mode.
  • COMMENT
    Defines additional information that you want to include in the record. 
    PAM Server Control
    does not use this information for authorization.
    Limit:
    255 characters.
  • CREATE_TIME
    (Informational) Displays the date and time when the record was created.
  • NACL
The
NACL
property of a resource is an access control list that defines the accessors that are denied authorization to a resource, together with the type of access that they are denied (for example, write). See also ACL, CALACL, PACL. Each entry in the NACL contains the following information:
  • Accessor
Defines an accessor.
  • Access
    Defines the type of access that is denied to the accessor.
Use the authorize deniedaccess command, or the authorize- deniedaccess- command, to modify this property.
  • OWNER
Defines the user or group that owns the record.
  • UACC
Defines the default access authority for the resource, which indicates the access granted to accessors who are not defined to 
PAM Server Control
or who do not appear in the ACL of the resource.
Use the defaccess parameter with the chres, editres, or newres command to modify this property.
  • UPDATE_TIME
(Informational) Displays the date and time when the record was last modified.
  • UPDATE_WHO
(Informational) Displays the administrator who performed the update.