Next Previous

5.1.1 HPSS ACL Editor - hacl

What follows is the HPSS manual page for hacl:

 

NAME

hacl - manage HPSS access control lists

 

SYNTAX

hacl [-x] [-v] [command ... ]

 

DESCRIPTION

The hacl utility is used to manage access control lists (ACLs) on

HPSS files. In particular, hacl can replace an ACL with a

different one, add new ACL entries or update existing ones, delete

selected ACL entries, clear out an entire ACL, and display ACLs.

To make it easier to change ACLs, hacl can also copy an ACL from

an existing file to another file.

 

If a command is supplied on the execute line, then the command is

executed immediately and control is returned to the shell.

Otherwise hacl enters interactive mode. In this mode, the user

can change working directories, look at the files in the current

directory, try out acl changes, and see the results of the

change. Interactive mode may also be used to read commands from a

script.

 

Access control lists are made up of individual ACL entries

separated by "white space". White space characters include

commas, semicolons, and newlines, as well as spaces and tabs.

Each ACL entry takes the form "<type>:<key>:<perms>", where:

<type> the ACL entry type (e.g., "user_obj")

<key> principal and/or cell name

<perms> the permissions (e.g., "rwx")

 

The <type> field can be any of the standard DCE ACL entry types,

including user_obj, group_obj, other_obj, user, group,

foreign_user, foreign_group, foreign_other, any_other, mask_obj,

unauthenticated, user_obj_delegate, group_obj_delegate,

other_obj_delegate, user_delegate, group_delegate,

foreign_user_delegate, foreign_group_delegate

foreign_other_delete, and any_other_delegate.

 

The <key> field takes the form /<cell>/<principal>. The <cell> or

<principal> may or may not be required, depending on the ACL entry

type. The <cell> can be specified with either a cell name (e.g.,

/.../hpss.ca.sandia.gov) or a cell id (e.g., /87654321).

 

Similarly, users can be specified either by name (e.g., hilary) or

by uid (e.g., 20021), and groups can be specified by name or gid.

Normally the user will use names rather than ids, but ids are

provided to deal with situations where the cell, principal, and/or

group have been removed from the security registry.

 

The <perms> field may or may not be required, depending on the

command. When required, the field is made up the characters

"rwxcid", signifying respectively read, write, execute, control,

insert, and delete. To specify that a permission is not wanted,

use a hyphen (-) or just omit the character corresponding to that

permission.

 

Many commands can optionally act on the initial container or

initial object ACL of a directory. To specify one of these, use

the -ic or -io flag on the command line. For example, to clear

the initial container ACL on mydirectory:

$ hacl clear -ic -f mydirectory

 

The -ic and -io flags are mutually exclusive. If neither is

present on the command line, then the object ACL itself will be

processed.

 

Many commands require that a list of ACL entries be entered. The

list can be specified in one of two ways using the -a or -A flags.

The flags are mutually exclusive.

 

If the -a flag is used, then <entries> is an explicit list of ACL

entries to be processed. If the -A flag is used, then <filea> is

the name of Unix file that contains the ACL entries. The format

of the file is flexible, but it is recommended that each ACL entry

appear on a separate line.

 

Many commands also require the user to specify the list of files

that are to be processed. The list can be specified in one of

three ways using the -B, -f, and -F flags. The flags are mutually

exclusive.

 

If the -f flag is used, it must be the last flag on the command

line. In this case, <files> is a list of files to be processed.

The list may contain files whose names begin with a hyphen. With

the exception of the "ls" command, the list may not contain

wildcards or escape characters.

 

If the -F flag is used, then <filef> is the name of a Unix file

that contains the names of the HPSS files to be processed. The

file must be formatted with one file to a line. Leading blank

characters are ignored, but embedded and trailing blanks are

considered to be part of the file name. Asterisks (*), question

marks (?), and escapes (\) are not translated but rather are

treated as part of the file name.

 

In addition a bulk file processing option MAY be available in some

future version of hacl. This option, selected by the -B flag, allows

hacl to change ACLs more efficiently. To use the option, a Unix

file must first be prepared containing the HPSS nameserver handle

and the name of each file that is to be processed. To prepare the

Unix file, use hacl's "ls -h" command. Once the file has been

prepared, use hacl's -B flag, naming the Unix file as <fileb>.

One of the examples below shows how to do this in more detail.

 

To designate input from stdin, use a hyphen (-) for the <filea>,

<fileb>, or <filef> parameters. Needless to say, only one of

these parameters can be set to stdin at a time. Moreover, the

hyphen cannot be used in interactive mode.

 

The "ls" is the only hacl command that accepts wildcards and

escape characters. The asterisk (*) and question mark (?) have

the same interpretation as they do in most Unix shells. The

backslash (\) is an escape character that can be used to represent

troublesome characters. The following escape sequences are

recognized:

\t the tab character

\' the apostrophe (')

\" the double quote (")

\(blank) the blank ( ) character

\nnn the ASCII character given by 1-3 octal digits

\\ the backslash (\) character itself

\(other) unchanged

 

Escape sequences are translated before wildcards are evaluated,

which has the practical effect that there is no simple way to

specify a file name that contains an asterisk or question mark.

 

Note that file names can either be specified as absolute or

relative path names. When hacl starts, it determines the user's

default working directory from HPSS. However, if the environment

variable HACL_DEFAULT_DIR is set, then its value will determine

the default directory. The directory can be changed by using

hacl's "cd" command.

 

Some commands support a -q flag. If the flag is missing, then

information is printed out for every file that is processed. For

example:

$ hacl copy -m model -f file.01 file.02

file.01 OK

file.02 Cannot change ACL. (No such name)

 

If the -q flag is present, only the commands that fail will be

reported. This makes it easier to see errors. For example:

$ hacl copy -q -m model -f file.01 file.02

file.02 Cannot change ACL. (No such name)

 

By default, when hacl encounters an error, it continues running,

processing other files and hacl commands until a quit or exit

command is seen. However, this can be dangerous if hacl is being

run from a script. For example, if a "cd" command fails, hacl

might end up processing files in the wrong directory. To prevent

this from happening, always use the -x flag when running from a

script. The -v flag should also be used so that hacl's messages

can be related to the commands that generated them.

 

PARAMETERS

command Optional one-liner command and parameters.

 

-x Terminate commands as soon as an error occurs.

 

-v Echo hacl commands to stdout.

 

COMMAND SUMMARY

acl Description of the syntax for access control lists

cd Change the working directory

clear Clear the entire ACL for one or more files

copy Copy the ACL from one file to one or more other files

echo Echo the arguments to standard output

exit Leave the program

help Get help on how to use hacl

ls List the files in a directory

purge Purge unused ACL perms to account for mask object

pwd Print the current working directory

remove Remove selected ACL entries from one or more files

replace Replace entire ACL with new ACL for one or more files

quit Leave the program

show Show the ACL for one or more files

update Update selected ACL entries for one or more files

usage Describe hacl's command line

 

COMMAND DETAILS

acl

Description of the syntax for access control lists

 

This is not a command per se, but rather a topic for which help

is available. Typing the command "help acl" results in a

description of the syntax for ACLs.

 

cd [<dir>]

Change the working directory

 

<dir> New working directory

 

If <dir> is missing, this command changes the current working

directory to be the user's default working directory.

 

clear [-ic | -io] [-q] [-B <fileb> | -F <filef> | [-f] <files>]

Clear the entire ACL for one or more files

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-q don't report successes

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

This command deletes all ACL entries except the user_obj,

group_obj, other_obj entries.

 

See the discussion section for a description of the flags.

 

copy [-ic | -io] [-q] -m <filem> [-B <fileb> | -F <filef> | \

[-f] <files>]

Copy the ACL from one file to one or more other files

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-q don't report successes

-m change ACL to that given by "model" file <filem>

<filem> an HPSS file whose ACL will be copied

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

The -m flag is used to specify the name of the HPSS file

whose ACL is to be copied. This flag is required.

 

See the discussion section for a description of the other

flags.

 

echo [<text>]

Echo the arguments to standard output

 

<text> the message text to be echoed

 

exit

Leave the program

 

help [-v] [<topic>]

Get help on how to use hacl

 

-v print more details

<topic> topic for which help is desired

 

If <topic> is omitted, print a list of topics for which help

is available.

 

ls [-a] [-h] [-l] [-f] [<files>]

List the files in a directory

 

-a list files whose names begin with a dot (.)

-h list file handles needed by the bulk ACL commands

-l list owner's cell name, user name, and group name

-f list the files named in <files>

 

The -f flag must be last on the command line. The <files>

argument can contain wildcards and escape characters. If one

of the files named is a directory, the directory itself will

be listed rather than the files in that directory. If <files>

is omitted, then all of the files in the current working

directory will be listed.

 

The "ls" command is the only hacl command that accepts

wildcards. To use wildcards on other commands, the output of

the "ls" command must be directed into a file or a pipe and

then read back into hacl using the -F flag. For example, this

will show the ACLs for all files whose names end in ".dat":

$ hacl ls -f '*.dat' | hacl show -F -

 

If the -h flag is used, the output of the "ls" command will be

in the right format to use as input to one of the bulk ACL

operations. For example, the following command copies the ACL

in myfile.dat to all the files in the current working

directory:

$ hacl ls -h -f '*' | hacl copy -m myfile.dat -B -

 

purge [-ic | -io] [-q] [-B <fileb> | -F <filef> | [-f] <files>]

Purge unused ACL permissions to account for the mask object

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-q don't report successes

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

See the discussion section for a description of the flags.

 

pwd

Print the current working directory

 

remove [-ic | -io] [-q] [-a <entries> | -A <filea>] \

[-B <fileb> | -F <filef> | -f <files>]

Remove selected ACL entries from one or more files

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-q don't report successes

-a ACL entries are explicitly listed

<entries> explicit list of ACL entries

-A ACL is determined by reading a file

<filea> Unix text file listing the new ACL entries

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

See the discussion section for a description of the flags.

 

replace [-ic | -io] [-m <type>] [-q] [-a <entries> | -A <filea>] \

[-B <fileb> | -F <filef> | -f <files>]

Replace entire ACL with new ACL for one or more files

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-m adjust mask object according to <type>

<type> either "calc" or "nocalc"

-q don't report successes

-a ACL entries are explicitly listed

<entries> explicit list of ACL entries

-A ACL is determined by reading a file

<filea> Unix text file listing the new ACL entries

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

See the discussion section for a description of the flags.

 

quit

Leave the program

 

show [-e] [-ic | -io] [-B <fileb> | -F <filef> | [-f] <files>]

Show the ACL for one or more files

 

-e show effective permisions considering mask object

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

See the discussion section for a description of the flags.

 

update [-ic | -io] [-m <type>] [-q] \

[-a <entries> | -A <filea>] \

[-B <fileb> | -F <filef> | -f <files>]

Update selected ACL entries for one or more files

 

-ic the ACL is an initial container ACL

-io the ACL is an initial object ACL

-m adjust mask object according to <type>

<type> either "calc" or "nocalc"

-q don't report successes

-a ACL entries are explicitly listed

<entries> explicit list of ACL entries

-A ACL is determined by reading a file

<filea> Unix text file listing the new ACL entries

-B bulk ACL change for files listed in <fileb>

<fileb> a Unix text file listing file names and NS handles

-F file names are determined by reading <filef>

<filef> a Unix text file listing file names

-f file names explicitly listed in <files>

<files> an explicit list of files

 

See the discussion section for a description of the flags.

 

This command can be used to add new entries to an ACL as well

as to change existing entries.

 

usage

Describe hacl's command line

 

EXAMPLES

To show the ACL on a file:

$ hacl show myfile.dat

 

To show the effective ACL on a file:

$ hacl show -e myfile.dat

 

To show the initial container ACL on a directory:

$ hacl show -ic mydir

 

To copy an ACL from a model file to several other files:

$ hacl copy -m model.file -f file.00 file.01 file.02

 

To copy an ACL to a list of files specified using wildcards:

$ hacl ls '*.dat' | hacl copy -m model.file -F -

 

To update a single ACL entry on a single file:

$ hacl update user:hilary:rwx file.00

 

To work with several ACL entries and files:

$ hacl update -a user:joe:rwx user:ann:cid -f f1 f2 f3

 

To run hacl interactively and work with mydir/file.00:

$ hacl

> show mydir/file.00

> cd mydir

> pwd

> ls

> update -a user:hilary:rwx -f file.00

> show file.00

 

To establish a default working directory (using ksh):

$ export HACL_DEFAULT_DIR=/home/hilary/mydir

$ hacl

> show file.00

 

To use an ACL specified in a Unix file:

$ cat myacls

user:joe:rwx

user:ann:cid

$ hacl update -A myacls -f f1 f2 f3

 

To modify the files listed in a Unix file:

$ cat myfiles

f1

f2

f3

$ hacl update -a user:joe:rwx user:ann:cid -F myfiles

 

To run hacl using a script:

$ cat myscript

update update -A myacls -f f1 f2 f3

update -a user:joe:rwx user:ann:cid -F myfiles

$ hacl -v -x < myscript

 

To generate and use the info needed by a bulk ACL command

$ hacl ls -h '*.01' > mybulk

$ cat mybulk

000002370000023700000000af4a81017ec823feee7511d1ab4708005a4726ef acl.01

0000023e0000023e00000000273381017ec823feee7511d1ab4708005a4726ef ftp.01

$ hacl update -A myacls -B mybulk

 

FILES

 

SEE ALSO

 

SCCS

static char SccsId[] = " @(#)33 1.2 man/hacl.7, gen, 5.1, 5.1.0.0 2/26/03 10:00:17";

5.1.2 List information about HPSS - lshpss

What follows is the HPSS manual page for lshpss:

 

NAME

lshpss - List information about HPSS

 

SYNTAX

lshpss [options ...]

 

DESCRIPTION

This utility displays various HPSS resources like Class of Service,

Hierarchy, and Storage Class.

 

The lshpss utility reads metadata directly from DB2. In order for it

to work, the user must be logged in as a user that has permission to

read HPSS metadata, such as hpss or the DB2 instance owner.

 

OPTIONS

 

-glob Show Global Configuration Data

-subsys Show Storage Subsystems

-cos Show Class of Service list

-hier Show Hierarchy list

-sc Show Storage Class list

-migp Show Migration Policies

-purgep Show Purging Policies

-vol Show Physical Volumes

-dev Show Mover Devices

-drv Show PVL Drives

-svr Show HPSS Servers

-mvr Show HPSS Movers

-acct Show Accounting Policies

-logp Show Log Policies

-locp Show Location Policies

-fset Show Filesets

-ffam Show File Families

-core Show Core Servers

-pvr Show PVRs

-logd Show Log Daemons

-logc Show Log Clients

-nfsd Show NFS Daemons

-listmeta List metadata

-all Display all of the above

 

-dumpmeta Dump all metadata for HPSS to separate files

-dump <table> Dump one metadata table

 

-s <database schema name>

If this is not specified, the contents of the

environment variable HPSS_MM_SCHEMA_NAME will be used

 

-g <global config database>

If this is not specified, the contents of the

environment variable HPSS_GLOBAL_DB_NAME will be used

 

-h Show this help message

 

 

EXAMPLE

The following command will list all the resources :

 

$ lshpss -all

 

To list classes of service and purge policies :

 

$ lshpss -cos -purgep

 

SEE ALSO

 

SCCS

man/lshpss.7, gen, 5.1 10/30/03 09:44:01