permissions

Product	Command type
ClearCase®	general information
MultiSite	general information

Platform
UNIX®
Linux®
Windows®

Description

In general, only commands that modify (write to) a VOB or a project VOB are subjected to identity checking. The following hierarchy of identity checking is used, in a command-specific manner, to determine whether a command can proceed or be canceled:

All products on UNIX and Linux only: root
All products on Windows only: Member of the ClearCase administrators group
VOB owner
Owner of the relevant element (for modifications to branches and versions)
Owner of the relevant type object (for modifications to objects of that type)
Creator of a version or derived object
Owner of the object (pool, hyperlink, replica, activity, checkpoint, domain, role, state, user)
User associated with an event
Members of an object's group (same group ID)
Note: Object in this case refers to objects in a VOB. A VOB object itself is not an object in a VOB and therefore group membership is not sufficient for commands that modify a VOB object itself. The group membership on a VOB is used to set the OS-level permissions on files and directories within the VOB storage area, not the permission to modify the VOB object itself.

Both file system and non-file-system objects have an owner and a group; this information is stored with the object. When an object is created, its owner and group are set to that of the user who created it. Use the protect command to change the owner (–chown) or group (–chgrp) of the object. The describe command displays the owner and group of the object.

The scheduler maintains its own access control list (ACL), which determines who is allowed access to the scheduler and to the ACL itself. See the schedule reference page for more information.

The reference page for a command lists the special identities (if any) required to use the command along with other restrictions on its use.

The sections below list all cleartool subcommands, categorized by their identity requirements. For information about identity checking for ClearCase commands (that is, other than cleartool subcommands), see the corresponding reference pages.

None

annotate apropos catcr catcs cd chactivity checkvob (except with –fix or –hlink) chfolder describe diff diffbl diffcr deliver dospace ¹ edcs endview (except with -server) file find findmerge ² get getcache getlog help hostinfo import ³	ln ⁴ ls lsactivity lsbl lscheckout lsclients lscomp lsdo lsfolder lshistory lslocal lslock lsmaster lspool lsprivate lsproject lsregion lsreplica lssite lsstgloc lsstream lstype lsview lsvob lsvtree lsws make	man mkactivity mkattype ⁵ mkbl mkbrtype ⁵ mkdir ⁴ mkelem ⁴ mkeltype ⁵ mkfolder mkhltype ⁵ mklbtype ⁵ mkproject mkregion mkstgloc mkstream mktag ⁶ mkview ⁷ mkvob ⁷ mkws mount ¹⁰ mv ⁴ mvws put pwd pwv quit	rebase recoverview reformatview register reqmaster (requesting mastership only) ⁹ rmname ⁴ ⁸ rmregion rmstgloc rmtag rmws setactivity setcs setplevel setsite setview setws shell space ¹ startview umount (public VOB) unregister update winkin wshell
¹ Except with –update or –generate
² No special identity required for “search” functionality
³ For created elements only
⁴ One or more directory elements must be checked out
⁵ Except with –replace
⁶ Except for private VOB tag
⁷ Standard UNIX and Linux or Windows permissions for creating a subdirectory required
⁸ Except with –nco
⁹ Must be on ACL at master replica
¹⁰ Only for public VOB

One of: element group member, element owner, VOB owner, root, member of the ClearCase administrators group; (for commands that operate on objects) object group member, object owner, VOB owner, root, member of the ClearCase administrators group

checkout

checkvob –hlink

import ¹

merge ²

mkattr

mkbranch

mkhlink

mklabel

mktrigger

reserve

rmattr

rmhlink

rmlabel

rmmerge

rmtrigger

unreserve

¹ For checked-out directories only

² Applies to creation of merge arrows only, not to data

One of: version creator, element owner, VOB owner, root, member of the ClearCase administrators group

checkin

rmver

uncheckout

One of: element owner, VOB owner, root, member of the ClearCase administrators group

chtype (element)

lock (element)

rmelem

unlock (element)

One of: user associated with event, object owner, VOB owner, root, member of the ClearCase administrators group

chevent

One of: branch creator, element owner, VOB owner, root, member of the ClearCase administrators group

chtype (branch)

lock (branch)

chmaster (branch)

rmbranch

unlock (branch)

One of: type owner, VOB owner, root, member of the ClearCase administrators group

lock (type object)

mkattype –replace

mkbrtype –replace

mkeltype –replace

mkhltype –replace

mklbtype –replace

mktrtype –replace

rename (type object)

rmtype

unlock (type object)

One of: pool owner, VOB owner, root, member of the ClearCase administrators group

rename (pool)

rmpool

One of: DO group member, DO owner, VOB owner, root, member of the ClearCase administrators group

rmdo

Note: Only the VOB owner and root, members of the ClearCase administrators group can delete a shared derived object.

One of: view owner, root, member of the ClearCase administrators group

endview -server

rmview

setcache –view

space –view –generate

One of: owner, VOB owner, root, member of the ClearCase administrators group

protect

One of: owner, project VOB owner, root, member of the ClearCase administrators group

chproject

chstream

rmactivity

rmbl

rmcomp

rmfolder

rmproject

rmstream

One of: owner, stream owner, root, member of the ClearCase administrators group

chbl

One of: owner, VOB owner, root, member of the ClearCase administrators group

chmaster (other than branch)

One of: VOB owner, root, member of the ClearCase administrators group

checkvob –fix

chpool

dospace –generate

ln –nco

lock (pool or VOB)

mkpool

mktrtype ¹

reformatvob

relocate

reqmaster (to set access controls)

rmname –nco

rmvob

space –vob –generate

umount (private VOB)

unlock (pool or VOB)

¹ except with –replace

One of: VOB owner, root, member of the ClearCase administrators group

checkvob –fix

ln –nco

lock (pool or VOB)

mkcomp

mktrtype ¹

reformatvob

rmname –nco

rmvob

setplevel

space –vob –generate

unlock (pool or VOB)

¹ except with –replace

VOB owner

mktag (private VOB tag) mount (private VOB)

View owner

chview (can also be root on view server host)

root, member of the ClearCase administrators group

setcache –host

setcache –mvfs

root, local administrator of the ClearCase VOB server host

protectvob

Same permissions as those for creating the corresponding type object

cptype

Permissions controlled by the scheduler ACL

dospace –update

schedule

space –update

permissions

Applicability

Description

None

One of: element group member, element owner, VOB owner, root, member of the ClearCase administrators group; (for commands that operate on objects) object group member, object owner, VOB owner, root, member of the ClearCase administrators group

One of: version creator, element owner, VOB owner, root, member of the ClearCase administrators group

One of: element owner, VOB owner, root, member of the ClearCase administrators group

One of: user associated with event, object owner, VOB owner, root, member of the ClearCase administrators group

One of: branch creator, element owner, VOB owner, root, member of the ClearCase administrators group

One of: type owner, VOB owner, root, member of the ClearCase administrators group

One of: pool owner, VOB owner, root, member of the ClearCase administrators group

One of: DO group member, DO owner, VOB owner, root, member of the ClearCase administrators group

One of: view owner, root, member of the ClearCase administrators group

One of: owner, VOB owner, root, member of the ClearCase administrators group

One of: owner, project VOB owner, root, member of the ClearCase administrators group

One of: owner, stream owner, root, member of the ClearCase administrators group

One of: owner, VOB owner, root, member of the ClearCase administrators group

One of: VOB owner, root, member of the ClearCase administrators group

One of: VOB owner, root, member of the ClearCase administrators group

VOB owner

View owner

root, member of the ClearCase administrators group

root, local administrator of the ClearCase VOB server host

Same permissions as those for creating the corresponding type object

Permissions controlled by the scheduler ACL

See also