When you create a VOB, it has a single element: the VOB root directory.
This element is the container for all other elements in the VOB. Its initial
owner is the owner of the VOB, and its initial group is the group of the VOB.
An element has these properties that are important
for access control:
- Owner. The initial owner is the user ID of the process that creates
the element.
- Group. On all supported operating systems, the group of an element
must be one that is in the VOB’s group list. When an element is created, its
initial group is determined differently on hosts running Linux® or the UNIX® system
than it is on Windows® hosts.
- On Linux and
on the UNIX system,
it is the primary group ID of the process that creates the element.
- On Windows, it is the primary group ID of the process
that creates the element if that group is on the VOB’s group list. Otherwise,
it can be any group that appears on both the group list of the process that
creates the element and the group list of the VOB, so long as there is only
one such group.
Note: On Windows, if the primary group ID of
the process that creates the element is not on the VOB’s group list and the
process’s group list includes more than one group that is also in the VOB’s
group list, the process cannot create an element in the VOB.
- Protection mode. The initial protection mode for a file element
is determined differently on hosts running Linux or the UNIX system than on Windows hosts.
- On Linux and
on the UNIX system,
if you create the element from an existing view-private file, the element
has the same protection mode as the view-private file, except that no user
category has write permission. If you create a file element any other way,
the element has only read permission for all user categories. If your umask is
0, a directory element initially has read, write, and execute permission for
all user categories. Otherwise, the initial read, write and execute permissions
are determined by the value of your umask.
- On Windows, a file element initially has only read permission
for all user categories. You must explicitly add execute permission for an
element by using the cleartool chmod command.
A directory element initially has read, write, and execute permission for
all user categories.
An element’s owner, group, and protection mode are the same for
all versions of the element.
You can use the cleartool describe command
or, on Windows, the Properties of Element window
in Windows Explorer
or Rational ClearCase Explorer
to display the owner, group, and protection mode for an element.
After an element is created, the element owner, the VOB owner,
or a privileged user can use the cleartool protect command
to change the element’s owner, group, or protection mode.
Permission to create elements
A
process whose primary group is one of the VOB’s groups can create elements
in the VOB.
Note: On Windows, if the primary group ID of
the process that creates the element is not on the VOB’s group list, the process
can still create an element if only one group appears on both the group list
of the process that creates the element and the group list of the VOB. If
the process’s group list includes more than one group that is also in the
VOB’s group list, the process cannot create an element in the VOB.
To
create an element, a process must also have permission to check out a version
of the directory element that will contain the new element. See Permission to write elements.
Permission to delete elements
Only
the element owner, the VOB owner, or a privileged user can delete an element.
Deleting an element with the cleartool rmelem command
is not the same as removing the element’s name from a version of a directory
using cleartool rmname. For more information,
see Permission to write elements.
The creator
of a version, the element owner, the VOB owner, or a privileged user can delete
the version.
Permission to read elements
An
algorithm that considers the process’s user and group and the element’s owner,
group, and protection mode determines whether to grant read permission for
an element. See Access algorithm for VOB and view data.
Permission to write elements
A
process cannot write elements directly. You modify an element by checking
out a version of it and checking in a new version.
The element’s protection
mode is not considered when determining whether a process can check out or
check in a version. A process can check out a version if any of these conditions
are true:
- The process has the user identity of the element’s owner.
- Any of the process’s group identities is the same as the element’s group.
- The process has the user identity of the VOB owner.
- The process has the user identity of a privileged user.
A process can check in a version if any of these conditions are
true:
- The process has the user identity of the user who checked out the element.
- The process has the user identity of the element’s owner.
- Any of the process’s group identities is the same as the element’s group.
- The process has the user identity of the VOB owner.
- The process has the user identity of a privileged user.
When a directory element is checked out, you can modify the directory
by creating elements or by removing elements from it. Removing an element’s
name from a version of a directory with the cleartool rmname command
is not the same as deleting the element itself. See Permission to delete elements.
Permission to execute elements
An
algorithm that considers the process’s user and group and the element’s owner,
group, and protection mode determines whether to grant execute permission
for an element. See Access algorithm for VOB and view data.
Two
special cases can restrict permission to execute an element: