Security for new objects

When you create a new object in the "root" (/) file system, the interface that you use to create it determines its authorities.

For example, if you use the CRTDIR command and its defaults, the new directory inherits all of the authority characteristics of its parent directory, including private authorities, primary group authority, and authorization list association. The following sections describe how authorities are determined for each type of interface.

Authority comes from the immediate parent directory, not from directories higher up in the tree. Therefore, as a security administrator, you need to view the authority that you assign to directories in a hierarchy from two perspectives:

How the authority affects access to objects in the tree, like library authority.
How the authority affects newly created objects, like the CRTAUT value for libraries.

Recommendation: You may want to give users who work in the integrated file system a home directory (for example, /home/usrxxx), then set the security appropriately, such as PUBLIC *EXCLUDE. Any directories the user creates under their home directory will then inherit the authorities.

Use the Create Directory command
When you create a new subdirectory by using the CRTDIR command, you have two options for specifying authority.
Create a directory with an API
When you create a directory by using the mkdir() API, you specify the data authorities for the owner, the primary group, and public (using the authority map of *R, *W, and *X).
Create a stream file with the open() or creat() API
When you use the creat() API to create a stream file, you can specify the data authorities for the owner, the primary group, and public (using the UNIX-like authorities of *R, *W, and *X).
Create an object by using a PC interface
You can use the creat() API to create a stream file.

Parent topic: Plan integrated file system security