Endpoint Administration Guide for UNIX › Managing Resources › Classes › Default Record for Class › UACC Class (Deprecated)

UACC Class (Deprecated)

The UACC class is no longer recommended. To specify the default values for records in a class, use the _default record.

Some earlier versions of CA ControlMinder used a separate class, called UACC, for records resembling the _default records of other classes. The UACC class is no longer recommended, and if you use a _default record, the equivalent record in the UACC class is not checked. In future versions, the UACC class may no longer be supported.

For example, suppose user Henderson tries to kill process store_log. CA ControlMinder checks for authorization in the following order. The primary question is this: Is the process store_log defined in the database? CA ControlMinder searches the database for a record named store_log in the PROCESS class.

• If no such record can be found, the process is not defined to CA ControlMinder. In that case, CA ControlMinder therefore uses either the _default record of class PROCESS, or the PROCESS record in the UACC class, to determine whether Henderson is allowed to kill store_log.
  • If user Henderson appears in the _default record's ACL, the authority specified in it is applied.
  • If Henderson does not appear in the _default record's ACL, the authority specified in the defaccess property of the _default record is applied. This authority is applied to all users who do not appear explicitly in the _default ACL.
• If process store_log is defined in the database, then the question is whether user Henderson appears in the ACL for process store_log in the database.
  • If user Henderson appears in the ACL for process store_log, the authority specified there is applied.
  • If Henderson does not appear in the ACL, CA ControlMinder applies the authority specified in the default access property of the store_log resource. This authority is called the resource's default access.

Note: If the default access (defaccess) of _default is set to NONE, or if _default is not specified and the default of the corresponding resource in the UACC class is NONE, then any accessor attempting to access a resource not defined in the class is denied access to the resource.

If the default access of _default (or UACC) is set to the highest authority (ALL, or in some cases READ or EXECUTE), then any resource that is not explicitly protected is accessible to everyone.