Access control for elements

When you create a VOB, it has a single element: the VOB root directory. This element is the container for all other elements in the VOB. Its initial owner is the owner of the VOB, and its initial group is the group of the VOB.
An element has these properties that are important for access control:
  • Owner. The initial owner is the user ID of the process that creates the element.
  • Group. On all supported operating systems, the group of an element must be one that is in the VOB’s group list. When an element is created, its initial group is determined differently on hosts running Linux® or the UNIX® system than it is on Windows® hosts.
    • On Linux and on the UNIX system, it is the primary group ID of the process that creates the element.
    • On Windows, it is the primary group ID of the process that creates the element if that group is on the VOB’s group list. Otherwise, it can be any group that appears on both the group list of the process that creates the element and the group list of the VOB, so long as there is only one such group.
      Note: On Windows, if the primary group ID of the process that creates the element is not on the VOB’s group list and the process’s group list includes more than one group that is also in the VOB’s group list, the process cannot create an element in the VOB.
  • Protection mode. The initial protection mode for a file element is determined differently on hosts running Linux or the UNIX system than on Windows hosts.
    • On Linux and on the UNIX system, if you create the element from an existing view-private file, the element has the same protection mode as the view-private file, except that no user category has write permission. If you create a file element any other way, the element has only read permission for all user categories. If your umask is 0, a directory element initially has read, write, and execute permission for all user categories. Otherwise, the initial read, write and execute permissions are determined by the value of your umask.
    • On Windows, a file element initially has only read permission for all user categories. You must explicitly add execute permission for an element by using the cleartool chmod command. A directory element initially has read, write, and execute permission for all user categories.

An element’s owner, group, and protection mode are the same for all versions of the element.

You can use the cleartool describe command or, on Windows, the Properties of Element window in Windows Explorer or Rational ClearCase Explorer to display the owner, group, and protection mode for an element.

After an element is created, the element owner, the VOB owner, or a privileged user can use the cleartool protect command to change the element’s owner, group, or protection mode.

Permission to create elements

A process whose primary group is one of the VOB’s groups can create elements in the VOB.
Note: On Windows, if the primary group ID of the process that creates the element is not on the VOB’s group list, the process can still create an element if only one group appears on both the group list of the process that creates the element and the group list of the VOB. If the process’s group list includes more than one group that is also in the VOB’s group list, the process cannot create an element in the VOB.

To create an element, a process must also have permission to check out a version of the directory element that will contain the new element. See Permission to write elements.

Permission to delete elements

Only the element owner, the VOB owner, or a privileged user can delete an element. Deleting an element with the cleartool rmelem command is not the same as removing the element’s name from a version of a directory using cleartool rmname. For more information, see Permission to write elements.

The creator of a version, the element owner, the VOB owner, or a privileged user can delete the version.

Permission to read elements

An algorithm that considers the process’s user and group and the element’s owner, group, and protection mode determines whether to grant read permission for an element. See Access algorithm for VOB and view data.

Permission to write elements

A process cannot write elements directly. You modify an element by checking out a version of it and checking in a new version.

The element’s protection mode is not considered when determining whether a process can check out or check in a version. A process can check out a version if any of these conditions are true:
  • The process has the user identity of the element’s owner.
  • Any of the process’s group identities is the same as the element’s group.
  • The process has the user identity of the VOB owner.
  • The process has the user identity of a privileged user.
A process can check in a version if any of these conditions are true:
  • The process has the user identity of the user who checked out the element.
  • The process has the user identity of the element’s owner.
  • Any of the process’s group identities is the same as the element’s group.
  • The process has the user identity of the VOB owner.
  • The process has the user identity of a privileged user.

When a directory element is checked out, you can modify the directory by creating elements or by removing elements from it. Removing an element’s name from a version of a directory with the cleartool rmname command is not the same as deleting the element itself. See Permission to delete elements.

Permission to execute elements

An algorithm that considers the process’s user and group and the element’s owner, group, and protection mode determines whether to grant execute permission for an element. See Access algorithm for VOB and view data.

Two special cases can restrict permission to execute an element:
  • On Windows, a file element does not have execute permission until you add it by using the cleartool chmod command. For example:

    cleartool chmod +x command.exe

    If you add an executable program to source control, you cannot execute it while it is checked in unless you take this step. (When it is checked out, you can execute the view-private file.)
  • On Linux and the UNIX system, when a VOB is mounted with the nosuid mount option, checked-in setuid executables cannot run.

Feedback