Note that this is different from setting individual files to be erased on deletion. Default policy Use of Erase On Delete is neither prohibited nor required. Customizing Set the limit for DISK_ERASEDELET_REQUIRED to TRUE in order to require all disk volumes to be set for Erase On Delete. selector

Limits

Exemptions

Ensure that protections on files not covered by other file protection elements fall within the restrictions set by policy.

Violation reports

Description

If a file's protection setting is not restrictive enough, unauthorized users will be able to read, write, execute, or delete the file in question. If the setting is too restrictive, users generally find a less acceptable way of sharing information to get their job done. Typically, they share their password or make an unauthorized copy of the file somewhere else.

The purpose of this test is to ensure that file protection settings are within the limits set by the security manager.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

By default, a minimum of 0 percent of users must have access and a maximum of 10 percent of users may have access. Customizing Limits for constraints ABSOLUTLO and ABSOLUTHI take the same form as a standard VMS file protection setting. The syntax for this is explained in some detail in VMS documentation. The default settings shown in the limits table below are good examples of how to specify which class of users are allowed which type of access. These are the codes involved:

• S=System account (or users with the SYSPRV privilege)
• O=Owner of the file
• G=Group (i.e., other users in the same UIC group as the owner)
• W=World (i.e., all other users)

• R=Read
• W=Write
• E=Execute
• D=Delete

Limits

Exemptions

Ensure that protections on files in SYS$HELP and SYS$LIBRARY fall within the restrictions set by policy.

Violation reports

Description

If a file's protection setting is not restrictive enough, unauthorized users will be able to read, write, execute, or delete the file in question. If the setting is too restrictive, users generally find a less acceptable way of sharing information to get their job done. Typically, they share their password or make an unauthorized copy of the file somewhere else.

The purpose of this test is to ensure that file protection settings are within the limits set by the security manager.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

The file protection setting must allow at least the system to read, write, access, and delete the file. By default, the weakest acceptable file setting allows the system and owner to read, write, execute, and delete the file, and also allows other users in the owner's UIC group to read and execute the file. By default, other users outside the owner's group are allowed NO access to the file.

By default, a minimum of 0 percent of users must have access and a maximum of 10 percent of users may have access. Customizing Limits for constraints ABSOLUTLO and ABSOLUTHI take the same form as a standard VMS file protection setting. The syntax for this is explained in some detail in VMS documentation. The default settings shown in the limits table below are good examples of how to specify which class of users are allowed which type of access. These are the codes involved:

• S=System account (or users with the SYSPRV privilege)
• O=Owner of the file
• G=Group (i.e., other users in the same UIC group as the owner)
• W=World (i.e., all other users)

• R=Read
• W=Write
• E=Execute
• D=Delete

Limits

Exemptions

Ensure that specification of File Highwater Marking for disk volumes conforms to local policy.

Violation reports

Description

When File Highwater Marking is specified for a disk volume, users are prevented from reading the previous contents of space now allocated to their files.

Limits

Exemptions

Under VMS V5 "erase on extend" implementation is still used for relative and indexed files, but the overhead introduced is not usually noticed because of the overhead already present in creation or extending relative and indexed files. 

Ensure that unauthorized images are not installed.

Violation reports

Description

Installation of a shareable image declares it "trusted" and accessible by privileged programs. This test can be used to ensure that only authorized programs are installed.

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all installed images on the system.

Limits

Exemptions

Ensure that unauthorized images are not installed with privilege.

Violation reports

Description

Installation of an executable image with privilege allows unprivileged users to perform privileged operations when running the program. Such programs must be carefully constructed to ensure that only the designed functions can be performed. Installation of a program with privilege when it was not designed to be installed with privilege is a major security hazard. This test can be used to ensure that only authorized programs are installed with privilege.

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files on the system that are installed with privilege.

Thus, it can be set once for each possible privilege. When using the Command Interface if you do not specify a selector when changing the limit or exemptions your change applies to all privileges.

Limits

Exemptions

The test ABSOLUTHI is sufficient to express simpler limitations based on privilege level.

If a more complicated selection of privileges is required, it may be necessary to use the test PRIVPROHIB.