Implementing Ownable Resource Security › SFS Command and Directory Protection › Securing SFS Directories

Securing SFS Directories

The DIRECTRY resource class is used to restrict user access to particular SFS directories. The syntax is as follow:

   TSS PER(acid) DIRECTRY(directory[:subdirectory,],...)
       [FILE(filename)] [POOL(filepool)] [ACCESS(level     )]

directory

specifies the SFS directory name. You can optionally specify one or more subdirectories within that particular directory. Extended masking is supported using the %, *,and + characters. If you intend to use the “+” as a masking character, you should note that it is also considered a valid character for CMS directory and file names.

Up to five (5) directories can be specified per PERMIT.

FILE

specifies a particular file or file prefix within that directory. The FILE parameter is optional.

POOL

Specifies a particular file pool (SFS server machine) in which the directory is located. This parameter is also optional and can be used when there are two like named directories existing on different file pools.

ACCESS

specifies the type of access the ACID will have to that directory. DIRECTRY supports the following access level:

• CREATE
• READ
• WRITE
• UPDATE
• ALL
• NONE

If no access level is specified, READ will be assumed. UPDATE access is only supported for files that currently exist in the directory.

Note: If you have stored commonly used or accessed EXECs or files on an SFS directory, you should PERMIT that directory to the ALL Record with an access level of READ.

To better understand the use of the DIRECTRY resource class, consider the examples in the following section.