Rules Facility Guide › Security with the Rules Facility › About Creating Your Rules

About Creating Your Rules

When you create your own rules, your user ID is the target, and the rules are stored in a file with your user ID as the file name. Each rule has the following format:

action requester command

• The action can be either ACCEPT or REJECT and determines whether the requester’s command is allowed.
• The requester is the user ID that issues an AUTOLOG, COUPLE, DIAL, LINK, LOGON, LOGON BY, SPOOL, STORE HOST, TAG, TRANSFER, or XAUTOLOG CP command, a CA VM:Tape or CA VM:Schedule command, or a logon request using the LOGONBY Facility that affects your virtual machine. When a LOGON command is issued, the requester is a terminal address.

  The requester portion of a rule can be any of the following:

  • Specific user ID
  • Security group name, which specifies all members of the security group
  • All user IDs, represented by an asterisk
• The command can be one of the CP commands AUTOLOG, COUPLE, DIAL, LINK, LOGON, LOGON BY, SPOOL, STORE HOST, TAG, TRANSFER, or XAUTOLOG, the CA VM:Secure GROUP command, a CA VM:Tape or CA VM:Schedule command, or a logon request using the LOGONBY Facility. With LINK, optional parameters specify the virtual address and link mode.

The target user ID (your user ID) is not specified on the rule, but is specified when the rules file is created with the RULES command. For system override and system default rules files, the target user ID is all users. For security group rules files, the target user ID is all members of the security group. For user rules files, the target user ID is the user ID.

Your rules can be general in scope or very specific. A general rule might allow all users to obtain read access to your 191 minidisk. A specific rule might allow only user ID NORMP to obtain read access to your 191 minidisk.

A rule can also specify a group of user IDs as the requester. User IDs are grouped in security groups, and each security group has a name. To determine your security group, review your directory entry with the USER or MAINT command and locate the ACIGROUP statement. The name specified after ACIGROUP is your default security group.

To determine your current security group, if you have GROUP command authorization, enter the following:

vmsecure group ?