1 Safety
   Safety (tm) is a comprehensive data safety package offering enhanced
  file access controls, soft linking, deletion protection (and RELIABLE
  undelete support), and some features of hierarchical storage control and
  space management.
 
2 Commands
   A number of commands exist to control Safety and its components.
3 MarkSDH
  MarkSDH and MarkFile are used to set file security attributes.
 
  MarkSDH runs a full screen interface to select a set of files and
  allows a set of files to be selected in the current directory tree.
  When all files are selected, you type the "G" character (for "go")
  and enter a security selection menu identical with that in MarkFile
 
  MarkSDH selects access control and integrity attributes in a menu
  oriented way. You pass it a set of files (a file spec, with a
  possibly wildcarded name) or single file to mark and specify how
  and by whom it may be accessed. See the user manual for complete
  detail, or just follow the menu. There are also menu items for
  database maintenance and global checking.
 
3 MarkFile
  MarkSDH and MarkFile are used to set file security attributes.
 
  MarkFile selects access control and integrity attributes in a menu
  oriented way. You pass it a set of files (a file spec, with a
  possibly wildcarded name) or single file to mark and specify how
  and by whom it may be accessed. See the user manual for complete
  detail, or just follow the menu. There are also menu items for
  database maintenance and global checking.
 
3 FILEPASSWORD
  FilePassword allows you to enter a password to permit you access to a
  file. The command is FilePassword filespec password
  and it will prompt for file spec (must be a single file) and/or
  the password if these are omitted.
3 UNDELETE
  Undelete will undo a delete operation. The syntax is simply
 
  UNDELETE filepath
 
  where filepath is the complete path to the file to undelete. Wildcards
  may be used in the path, according to VMS STRING rules, to specify parts
  of pathnames that don't matter. Thus if you accidentally deleted
 
   disk$foobar:[mumble.fratz]myveryimportant.file;34
 
  you can say
 
  UNDELETE *myveryimportant.file*
 
  and get the file back (it goes back exactly where it came from.)
 
  Note that if the file has been EXPUNGEd or was deleted long enough ago
  to have been emptied out of the wastebasket it may not be recoverable.
 
3 MoveHSM
  The MOVEHSM command runs a full-screen file selection tool which allows
  files in the current directory tree to be selected and then (when the
  user types "G") a how-to-move files script comes up. This script is a
  full screen menu script allowing files to be moved in a standard shelving
  mode, or can copy a file and create softlinks or read-only softlinks
  to the copy. (A softlink will access that file in place for all
  applications. A readonly softlink will open the linked-to file if the
  original file is opened for read, but otherwise will inswap to the original
  disk. In both softlink cases, a particular file name and version are
  linked.)
3 MoveFile
  The MOVEFILE command runs a full screen menu  script allowing files to be
  moved in a standard shelving mode, or can copy a file and create
  softlinks or read-only softlinks to the copy. (A softlink will access
  that file in place for all applications. A readonly softlink will open
  the linked-to file if the original file is opened for read, but otherwise
  will inswap to the original disk. In both softlink cases, a particular
  file name and version are linked.)
 
3 Expunge
  The command
 
   EXPUNGE filespecs
 
  deletes the files spefified, and does not protect so that the UNDELETE
  command cannot be used, but space occupied is released immediately.
 
3 SoftLink
   The command
 
   SOFTLINK/TO:device[directory]file.typ srcdevice:[srcdir]srcfile.typ
 
   creates a soft link so that an attempt to open
  srcdevice:[srcdir]srcfile.typ will instead open
  device[directory]file.typ. The link is specific to one particular file
  version, so that editing a softlink will generally create a new version
  of srcfile.typ, for example. The capability should be used with this in
  mind. The command
 
  SOFTLINK/REMOVE srcdevice:[srcdir]srcfile.typ
 
  will in turn remove this softlink. While a softlink is in effect, any
  image not exempt from Safety cannot access the original file that may
  have been in srcfile.typ. (Thus these files can profitably be zero
  length.)
 
3 JTREPORT
  The JTREPORT command will show what Safety servers are active, what
  devices they control, and what capabilities they offer.
3 JTKillServer
  The JTKillServer command displays Safety servers active, and permits one
  or more of them to be cleanly turned off.
2 Expert-mode_Command_Line_Commands
 
  EACF and DPS have a somewhat obscure command line interface. It is
  intended that this interface generally NOT be used by users, but
  be used by way of command scripts that are part of the package. However,
  in order to make it possible for the packages to be called from normal
  scripts this document is supplied to describe the format of the command
  line interface to EACF and DPS.
 
3 JTDMN_Command_Switches
   The JTDMN command is used to start the main Safety server and control
  its functions.
 
  This server handles three sets of functions:
 
  open - gets control on io$_access if my ACE is there or if filenum
                 is in knl list in ucb. Handles security, swaps,
                 softlinks, etc.
 
  extend - gets control on extend & create if disk has too little
                 free space left and request is < 1/8 of disk size.
 
  delete - gets control on delete operations. Used to check file accesses
                 where delete is attempted to ensure extended checks are
                 met.
 
4 Function_switch_values
  Control flags in ucb$l_ctlflgs work by bits. These are set with the
  /function:nnnnnnn switch to the JTDMN command. The following are the
  meanings of the bitmasks.
 
         1       -       Allows access filtering. Used to recognize
                         files to move, check security on, etc.
         2       -       Examine modify
         8       -       CBT setup on create (only)
         16      -       Look at create function (does CBT setting
                         and possible space control)
         32      -       CBT on create or modify
         64      -       Send del dmn msg only if filenum stored, if
                         set. Otherwise send always. Used to ensure
                         if knl tagging exists that the delete testing
                         can be done.
         128     -       If set allow delete
                         daemon to control deletion. Two functions here.
                         One is that if the file is in our "kernel list"
                         we flag specifically for the delete daemon to
                         check whether delete access is permitted. (In fact
                         all deletes are security checked if this bit is set,
                         so we get good coverage.)
         65792   -       If either bit set (65536 + 256), look at deaccess
                         (close).
         512     -       Space control ok if set
         1024    -       If set, check for FIDs with rvn bit 8 set and
                         high filenum bit 8 set and lets access
                         filtering be done. To be used for "full" softlinks
                         when a directory-generator is built. (Don't use
                         yet!)
         2048    -       Prevent opens if device is privately owned on files
                         save by volume owner. Blocks access EVEN if privs.
         4096    -       Allow size control only if aldef bit set
         16384   -       Set aldef bit always to use default alloc.
         32768   -       Pretend we see an ACE on ALL files on disk
         65792   -       If either bit set (65536 + 256), look at deaccess
                         (close).
         262144  -       If set, examine only files with filenum in
                         kernel list (instead of looking for ACL on
                         all). Designed to save time where only a few
                         files (few :== under 512) are known to be of
                         security interest.
         524288 -        Allows deletes to open softlinked files to delete
                         the softlinked files. Normally this is inhibited
                         since the softlinks and not the linked-to files should
                         be deleted to avoid dangling links. The override
                         condition occurs only if this bit is set.
         1048576 -       Veto r/w logical from user mode channels if the
                         disk is mounted non-foreign
 
4 Sharing_JTDMN_servers
  The /SHARE:jtau: switch says that this JTAn: unit
  will share the same daemon with already set up unit JTAu:, whose
  daemon must already exist.
 
4 Starting_the_server
  The daemon would normally be started with a command:
 
  $ jtdmn/fcnmsk:65833/key:my-security-key JTAn: DUAm:
 
  where JTAn: is a unit of the JTdriver intercept driver, and
  DUAm: represents some disk on the system. Additional switches
  /FILENUM:file and /SHARE:jtau: can be used to load file numbers
  from a file somewhere on the system. These file numbers will be
  treated as though they had ACE tags on them whether they exist
  or not (as protection against malicious tampering with the file
  ACEs that EACF uses).
    A bitmap is used to store file numbers that are tagged, so that
  it is possible to kernel-tag ALL files in use in this way. Hence
  EACF protection is able to be provided for all files tagged. Also,
  by setting the function mask bit 262144 is set and the 64 bit is
  set, then file ACLs are looked for only for files known to be tagged.
  If most of your files are not tagged, this means you incur the small
  amount of kernel processing in reading tags only for those files
  that are tagged (and a few aliases, since a hashing technique is used
  to keep the bitmap size modest). This can be particularly significant
  on deletions, since in that case all deletions must be fed to the
  daemon unless tagged.
 
4 Stopping_the_server
  When the daemon is to be disabled, the command
 
  $ jtdmn/deas JTAn: DUAm:
 
  must be given to complete deassignment. Until this is done, the JT
  unit is busy and cannot be used for another assignment.
 
4 Files_used_during_server_operation
  Files used during operation:
 
  gcy$cm:filsav.com - save file somewhere
    ($@gcy$cm:filsav dev:file.typ hexfid1 hexfid2)
     dev:file.typ is filename passed to jtauthmaint for file.
     hexfid is hexfile id value, z8.8, 1x, z8.8)
  gcy$cm:sd<disk>.GDB - sequential delete record
    (xformed_filename,devicename,orig_filespec)
    (comma-delimited)
    (xformed filename is
     <jul. day-9 digits><second-5 digits><hexfid,12 digits><device>.sav
    )
  gcy$cm:softlk.com - softlink file, truncate original one.
    ($@gcy$cm:softlk orig_filename new_loc_filename filnum filseq filrvn
     where last 3 are the 3 parts of FID)
  gcy$cm:filrst.com - restore file saved somewhere
    ($@gcy$cm:filrst dbname zfid1 zfid2 size_in_blocks orig_filename)
    (orig_filename is filename passed in file marking w/dvc)
    (dbname is <node>$<dvc>$<unit>.gdb or
               <alcls>$<dvc>$<unit>.gdb)
  gcy$cm:fildel.com - delete a file (copy nominally, command file)
    ($@gcy$cm:fildel dbname zfid1 zfid2)
    (dbnam is <node>$<dvc>$<unit>.gdb or
              <alcls>$<dvc>$<unit>.gdb)
  jtd$db:op<disk>.gdb - ISAM disk database for eacf
  "@jtd$cm:makspc dbnam neededspace" - Get "neededspace" new free blks on
         disk. dbnam is delimited db name $alloclass$dvcunit: or
         node$dvcunit: (might be in filename form) and neededspace
         is in decimal. Should figure out desired files to move to
         nearline storage and move enough to make desired space. Called
         when space is lacking for create, extend, or inswap.
 
4 Logical_names_used_by_server_and_other_Safety_componenents
  Logicals:
  GCY$DELINC - File strings that may be saved from deletion
  GCY$DELEXC - File strings that should be deleted anyway (e.g. *.OBJ*)
  GCY$DELSAV - master control for delete protection, if "Y" do it.
  GCY$DELMNT - if equal to "OK" then delete EACF database entries when
                 a delete is to be let thru EACF (even if DEC protection
                 will disallow the delete). Otherwise leave alone.
  GCY$PARAND - If defined as "OK" allows "paranoid mode" checking and checking
                 if flagged of files' open by user cmd file
  GCY$SPWN1 - If it translates to Y (or 1st char is Y) then deletion
                 by spawn will use lib$spawn every time and therefore
                 not leave any extra processes around. Otherwise it
                 will create a "kept" subprocess which will get commands
                 via mailbox to issue deletes etc. from. (This will
                 greatly speed up such processing, but does require an
                 extra process per daemon.)
  GCY$SPWN2 - If it translates to a Y (or 1st char is a Y) then file inswap
                 will be done via a spawned subprocess using lib$spawn to
                 get a new one for every inswap. Otherwise a "kept"
                 subprocess will be started and it will be passed
                 commands via mailbox after the first inswap. This is faster
                 than spawning every time, but may be wasteful if inswap
                 is comparatively rare. Note that if the translation of the
                 logical is at any time other than Y, the kept process
                 will be started. The process will remain until the daemon
                 exits.
  JTM$SWPOP      Action that is used basically for file out/in swap. Can
                 be "SWAP" for in/out swap (default), "LINK" (normal soft
                 link), or "RLNK" ("readonly softlink"). Set up by JT_SETUP.
  DELSAV:        directory, or dev:[directory] where deleted files or
                 shelved files are to be saved. Needs to be only a directory
                 if using rename mode delete protection, or a device:[directory]
                 otherwise.
  JTDEL$MODE     Numeric value of mode of deletion handling.
  mode bits Meanings:
   Bit   Meaning
   0-1   0 = use .COM file
         1 = use rename mode
         2 = use copy (callable cvt) mode
         3 = copy and add softlink. No database file genn'd
   2     If set don't delete ANYthing immediately
   3     If set don't include only included names
   4     If set, delete file if no room for rename/copy
         If clear, leave file alone if copy area is full (return error though)
   5     If set, no timetag on deleted files (use if using softlink...)
   7     If set, delete files in shelf area as well, if they exist.
         mode=mymode()
   9     If set overrides bit 4 so del_shelved can be called, still fakes
                 success in user's delete
   10    If set, inhibits delete of database entry when deleting via del_shelved
   12    If set, then when one deletes FID (5,20,0) (which doesn't exist)
                 then run @gcy$sys:dps_process_deletes so that deletions
                 can be handled right then. (The sequential record is left
                 normally closed.) The delete of fid (5,20,0) is faked then.
 
  JTD$DB         Location where Safety databases are kept. Ideally this
                 should be a fast device. (This can be separate, a job
                 name, for each server if there are more than one.)
  GCY$CM         Location where .COM files used by Safety are kept. Should
                 also be fast. Defaults to same area as JTD$DB.
  GCY$SYS        Location where Safety executables are kept (except for
                 JTdriver).
  GCY$SCRATCH    Scratch storage used where Safety is told to compress swapped
                 files for shelving or unshelving; used to hold files during
                 these operations, so that write-once storage can be used
                 or tape can be used to hold files.
  SAFn_stuffm    Logicals used to record information about what disks
                 and JT devices are in use, modes, information about the
                 Safety servers, and so on. Set up at Safety startup
                 and used by various reports.
 
 
4 Exempting_a_process_from_Safety_controls
 
  Note JTexempt.exe will, when run, exempt its process from EACF
  controls on a particular disk. It takes a JT device unit name
  as its argument. However, the facility of "exempt" image pathnames
  (as supported in jt_setup.com & jtdmn.exe) seems more promising. This
  allows any images (up to 32 of them) to be declared exempt from
  EACF mods. One would use this for things like defraggers and the like.
  Note that ACCESS to these exempt images can still be controlled; they
  are exempt from access controls only once they get started.
 
  The JXSET command sets one as exempt (and logs this) or un-exempt
  from Safety. Should be permitted only to selected trusted people.
  JXSET/ALL disables Safety checks. JXSET/Normal restores them.
 
4 Server_command_formats
  JTDMN command:
 
  Normal command format:
 
  JTdmn/qualifiers JTAn: disk-to-intercept:
 
  Qualifiers:
 
  ASSIGN         -       use to begin an intercept
  DEASSIGN       -       use to end an intercept (must be used before
                                 another intercept can begin)
  KEY:string     -       Specifies string as the security key for this
                                 volume. Used as part of the checks that
                                 ACEs modifying privs, identifiers, or
                                 base priority are ok.
  MODE:nnn       -       Sets mode mask. Mask bits control how shelving
                                 or deletion is controlled.
                          Mode meanings (used for delete etc...)
                          Bit   Meaning
                          0-1   0 = use .COM file
                                1 = use rename mode
                                2 = use copy (callable cvt) mode
                                3 = copy and add softlink. No database
                                         file genn'd
                          2     If set don't delete ANYthing immediately
                          3     If set don't include only included names
                          4     If set, delete file if no room for rename/copy
                                If clear, leave file alone if copy area is full
                                         (return error though)
                          5     If set, no timetag on deleted files (use if
                                         using softlink...)
                          6     If set causes delbak.com to be run before
                                 actual deletions is done
                          7     If set, allows system to spawn command
                                 @GCY$SYS:DEL_SHELVED shelvedfile delfile
                                 to allow it to delete the shelved file (or
                                 whatever).
                          9     If set, overrides bit 4 being set so that
                                 bit 6 type delete action can be taken. (If
                                 bit 4 is set, system fakes delete success
                                 for user. If bits 7 and 9 are set, the command
                                 file can delete both files if it likes.)
                         10     If set, prevents database entry from being
                                 deleted on operations controlled by bits 7&9.
                         13     If set, replaces setting GCY$DELMNT to OK
                 Note that for bits 7, 9, and 10 to be meaningful, the system
                 logical GCY$DELMNT must be set to "OK" or bit 13 must be set.
  FCNMSK:nnnn    -       Sets function enable mask. See above for bit
                                 meanings.
  CBT:m          -       Sets to do contiguous-best-try file extends
                                 every mth extend. Default is equivalent
                                 to a /CBT:1 switch.
  FRACTION:n     -       Sets to extend files by fraction 1/n of their
                                 size. Default is equivalent to
                                 /FRACTION:4 which causes extends to be
                                 1/4 of the file size (+1) by default.
  MODIFY         -       Causes JTDMN to just change parameters of a JT
                                 unit, not to act as a daemon.
  FILENUM:file   -       Causes JTDMN to read in file and use it as a list
                                 of file numbers of marked files. These
                                 files then are treated as though they
                                 had tagging ACEs on them even if no such
                                 ACEs are found.
  EXEMPT:file    -       Causes JTDMN to read in file as a list of path
                                 names of images exempt from EACF security
                                 or DPS protection. Up to 32 such paths
                                 may be in the file. Wildcards are
                                 permitted within them, matched to the
                                 image path with str$match_wild.
  SHARE:jtam:    -       Causes JTDMN to enable the JTAn: on its command
                                 line but use the same EACF/DPS server
                                 as currently used by JTAm:, so that one
                                 server can serve many disks.
  MINIMUM:nn     -       On extend, set extends to at least nn blocks (if
                                 free space on disk allows)
  MAXIMUM:mm     -       On extend, do not force extends to be larger than
                                 mm blocks (unless the user request is for
                                 more; we NEVER reduce a user extend
                                 request.)
  ALDEFONLY      -       On extend, only increase extend amount if the
                                 ALDEF bit is set (indicating the program
                                 is telling VMS to use volume default
                                 extend).
  LICENSE        -       Print system ID string on the console.
  INSTALL:key    -       Install license key in the system.
 
  Note that the /LICENSE and /INSTALL:keystring qualifiers don't actually
  use any other arguments, so dummy arguments may be used in these cases.
 
 
 
3 Function_Control
   There is a utility which is used to set up file security, actually outswap
   files, set up or remove softlinks, or report on file markings.
 
  Currently there is a commandline driven interface to control file security.
  Its function is to:
 
   * Maintain security access ACE entries on files on a disk
   * Display contents of security database
   * Update or clear fields of security database
 
  The control interface is handled via the JTAUTHMAINT utility (for the
  most part).
 
  Commands to jtauthmaint are of form
 
  filename\commands
 
  where filename is any file name one likes. The disk part of the name
  is used to select which database name to be used (the databases live
  in area GCY$CM:) and the filename is used to find the file ID, which
  is the record index.
 
  The commands are just strung together, being designed to be concise and
  easy to parse, though not necessarily easy to read by hand. Remember,
  the intent is to generate databases assuming a DCL layer at least is
  between us and the user. (This layer will use some fullscreen tools
  also, so privs will be entered by name, not by mask, as will identifiers
  and the like.)
 
4 JTAUTHMAINT_commands
  The commands are composed of short substrings. In EACF the following
  such substrings are relevant:
 
  %SYMS                  Generates a set of DCL symbols with various
                         fields of the current file (for use by user
                         interface). Gets basically all data into
                         DCL symbols.
  Symbols are:
    JTA_ZFID     - File id, hex
    JTA_ITIM     - Permitted usage by time (24 chars)
    JTA_MXPV     - Max privs (hex mask)
    JTA_CKSM     - Checksum (hex mask) (0 means none)
    JTA_PSWD     - File password hash (0 means no password)
    JTA_USRS     - OK users
    JTA_FUSR     - Forbidden users
    JTA_TTYS     - OK TTYs
    JTA_FTTY     - Forbidden TTYs
    JTA_IMGS     - OK Images
    JTA_FIMG     - Forbidden images
    JTA_BKPU     - Backup user list ("superuser list")
    JTA_FNAM     - Filename as stored
    JTA_CSLK     - conditional softlink dvc:file
    JTA_NSLK     - normal softlink dvc:file
    JTA_INSP     - inspectme flag - space or I+
    JTA_BPRI     - baseprio set - space or base prio
    JTA_RPRV     - Replacement privs vector (hex)
    JTA_IDNT     - Identifier hex value. Note only one is reported even though
                        the system will allow more. Space if none.
    JTA_SURW     - superuser (backup) read-only access. 'R/O' or 'R/W'
    JTA_ZCMD     - command to execute if access is rejected
 
  %DELETE                Delete database file entry for this file
  %PURGE                 Goes over the entire data base and checks that
                         the files in it exist. Any records referring
                         to files that cannot be found are deleted.
  %REGEN                 goes over entire data base and re-enters any
                         ACEs that have been deleted but that should
                         be there (which are available in the
                         database for that purpose now).  Reports to
                         sys$output when such an action is needed.
                         Also reports to OPCOM.
  %SHOW                  display the whole record in a mostly dumped
                         form (or displays a message that none exists)
  %LIST                  Write a list of filename/file-ID pairs out
                         of all files in the database. Symbol
                         JTA_LISTFILE returns with file spec of the file
                         written. Files appear as filename (n1,n2,n3)
                         where "(n1,n2,n3)" is the file ID.
  %SUMM                  Writes a list of filename/file-ID pairs out of
                         all files in the database, with file sizes also.
                         Symbol JTA_SUMMLEN returns with total blocks in
                         the files selected, and symbol JTA_SUMMFILE
                         returns with the filespec of the file written.
                         Format of the lines is as in %LIST but with
                         file size afterwards.
  %GBLEDIT `oldstring`newstring`
                         Replaces all occurrences of "oldstring" in
                         the database with "newstring" (or just deletes
                         "oldstring" everywhere if newstring is null.
                         Any delimiter character in neither string may
                         be used (provided it's printable...). This should
                         be a handy way to remove users and so on.
  %GBLEDITCON `oldstring`newstring`
                         works like GBLEDIT but requires confirmation at
                         command line for each change. Replies Y or N
                         confirm or deny the current replacement,and
                         reply A says accept all further edits, and reply
                         X means do no further edits.
  %REPORT                Creates a report file showing basically all the
                         info about the database file for this device.
                         The filename is stored in symbol JTA_RPTFILE
                         (the DCL symbol).
 
  Database files are kept in jtd$db:op<diskname>.GDB, where "diskname"
  is concocted from the device name. For example, disk ARISIA$VDB1:
  has a database file named OPARISIAVDB001.GDB. A report file will
  be named the same with "_REPO" appended, and the name in this
  example would be OPARISIAVDB001.GDB_REPO. A %LIST output file would
  be named the same with "_LIST" appended. In the example it would be
  OPARISIAVDB001.GDB_LIST.  These files should be purged (and by default
  the %LIST files are regenerated and purged every time Safety starts up.)
  Command files "live" in logical GCY$CM which by default is in the same
  location as the databases, directory JTD$DB, pointed to by a logical.
 
   The following keys refer to mods that are made as a file is opened
 
  K<key>                 Sets a security key string which should match
                         the /KEY:string switch used in running the
                         daemon. Such a match is needed to validate security
                         relevant ACE actions like priv or identifier modify.
  #Snn                   Base prio to nn where nn ranges 0-31. Sets the base
                         priority of the process to nn while the file is
                         open.
  P<mask>                Priv mask. Resets all process priv masks to the
                         mask here (16 hex digits) while the file is open.
                         Note this replaces masks, does not OR into them,
                         so it can raise OR lower privs.
  I<ident> Identifier    Assigns the identifier (expressed as 16 hex digits)
                         to the process while the file is open and revokes it
                         unconditionally when the file is closed. Multiple
                         identifier strings may be present.
 
    The following keys refer to access permissions which apply to both
         OPEN and DELETE access.
 
  I+                     inspectme tag. Sets a flag to tell EACF to send
                         a message to the access daemon to check this open.
                         (Settings of database fields as noted below should
                         be accompanied by this string to ensure they get
                         looked at.)
  V<maxprivmask in hex>  Max priv mask - Sets a mask of the MOST privs a process
                         may hold when opening the file. If the process holds
                         any more privs, the open fails. Thus one can disable
                         file opens via BYPASS or READALL even if the file is
                         normally world readable; a process holding these
                         privs would be denied access. If it disables them
                         it can then do the access.
  T<nnnnyyyyyyyyyyyynnnnnnnn> - time-value access permission
                         This sets access permission every hour. Each hour
                         is represented by one letter. Values known are:
 
                         Y - Access permitted provided all other security
                                 checks pass.
                         N - No access (except to users on backup list)
                         U - No CHECKS, let everything by EACF checks on this
                                 file during this hour. (DEC security remains
                                 in effect.)
                         P - Check privileges against max privs only
                         R - Readonly access only, by anyone; r/w opens are
                                 rejected. Other checks may deny access
                                 totally as well.
                         X - Allow r/o opens, test others normally.
                         D - Disallow access by ANYone (even superuser)
  Z<command>             - Command to execute if file access is denied. Note
                         it is executed even if a conditional softlink is
                         to be used. If "\" is in the string the command is
                         chopped there. Otherwise it gets the username,
                         terminal name, hex FID 1, hex fid 2, and hex PID
                         appended with spaces separating them (so a command
                         procedure can use them as P1 to P5 unless the command
                         itself contains more parameters first).
  &&                     Sets a mode where all opens are inspected and
                         a command file gcy$sys:filtall is run with args
                         fileid (hex), username, uic (hex), pid(hex),
                         accmode (hex), device (less $ initially if allocls)
                         are passed. If exit status is bad, access is
                         rejected. Filter in open only. The last arg is 0 if
                         a file opened by the paranoidmode file, 1 if it is
                         the paranoid mode file itself (&% set below).
  &%                     Sets the && command file to run for the file that
                         is to be checked by filtall also, with last arg as 1
                         in that case.
  X<command>             Command to execute. If cmd proc sends back "NG"
                         this rejects access. If it sends back "OK" as it
                         normally will, access is allowed. This test is
                         done only if access is permitted by other EACF
                         tests. A kept subprocess is used.
 
  The list maintenance commands below are all similar in form. They add
  to a list, subtract from a list, or replace a list;
   Note that lists may use * as a wildcard character (str$match_wild
  is used to test matches) and & means skip the test.
 
 
  commands of form L+<string> add to a list
    "       "   "  L-<string> subtract from a list
    "       "   "  L*<string> replace a list
 
  Lists are generally permitted to have wildcard characters (*) as usual
  with VMS.
 
  U+<add-username-permitted>     Add a name to the "permitted users" list
  U-<sub-username-permitted>     remove a name from the "permitted users" list
  U*<repl-permitted-user-list>   replace the "permitted users list"
                                 with this one
  V+<add-forbidden-user>         Add a name to the "forbidden users" list
  V-<sub-forbidden-user>         Take a name off the "forbidden users" list
  V*<repl forbidden user list>   Replace "forb. user" list with this one
  K+<add permitted-termname>     Add a terminal name (or substring) to the
                                         "permitted terminals" list. Note that
                                         terminal name and access port name are
                                         both checked.
  K-<sub-permitted-termname>     Remove a name from "permitted terms" list
  K*<repl permitted termname>    Replace "permitted terms" list.
  (note letter+, letter-, letter* pattern above...continue for all)
  L[+-*]<operate on forbidden termnames>  Edits the "forbidden terminal names"
                                         list.
  N[+-*]<image> - operate on permitted image list
  O[+-*]<forbidden-imagelist> -  operate on forbidden image list
  Q[+-*]<superuserlist -         operate on superuser list (or "backup users"
                                         since the intent is to allow a backup
                                         account to be workable without having
                                         to disable EACF.) Superusers are
                                         checked by time and r/o vs r/w only.
  Y[+-]<password> -              modify password on file. Sets the password.
                                 User must enter the password with
                                 password-entry tool before the file can
                                 be opened if password is set. Y-
                                 gets rid of password.
  Z+- - turn checksum on/off (on -> compute checksum). If the checksum is
                                 used, a cryptographic checksum is
                                 generated for a file. At any open, this
                                 is recomputed and the file will not open
                                 unless it matches. This prevents file
                                 tampering from going undetected, but
                                 beware: computing the checksum takes
                                 noticeable amounts of time. It is best
                                 used on short script files.
  W+-  Skip ace alteration if +, allow if -. Default allow. Lets the database
                                 be edited without touching the file's
                                 ACL.
  X+  eXpunge variable field stuff initially. If set, this zeroes all lists
                                         before starting.
  R+ or R-               Set backup user access to read/only (R+) vs read/write
                                         (R-). When R+ is specified, backup
                                         account opens must be read-only
                                         opens or they will be disallowed.
 
    The conditional softlink specification applies only to OPEN access
         and not delete, since it is a system action that takes place
         if access is to be denied. Delete processing does not use
         this and will simply be denied delete access if file access
         is denied; the conditionally softlinked file is NOT touched.
 
  C<dev:filename>        Set conditional softlink to dev:filename which
                                         is taken if access is denied
 
  Note that where normal or r/o softlinks exist, most file operations
  affect the softlinked file, NOT the original one. If the operation
  internally opens the file, the softlinked file is accessed instead
  of the original one.
 
  H<dev:filename>                Set normal softlink to dev:filename (uncond)
  #<dev:filename>                Set normal softlink, read-only type
 
  There is a component to create file passwords. These get left around
  scrambled into logicals in a UIC dependent way (to make it harder for
  people to grab them from each other). File passwords are generated
  by a command that looks like
 
  FILEPASSWORD filespec password
 
  The remaining components are the intercept driver, which needs a unit
  to be connected for each disk which EACF is to protect, and the
  daemon which does the bulk of the work (and incidentally does the
  connection to EACF's intercept driver from a disk). One daemon may
  service one or more disks; the degree of parallelism in accessing the
  disks depends entirely on customer desires.
 
  The passwords are entered with a command
 
  jtdolog filespec password
 
  or
 
  jtdolog fileid password
 
  where fileid is of form (n1,n2,n3) in parentheses. Care must be
  taken NOT to open the file first, since this access can be rejected
  until the file password is entered. When using the second form of
  password entry, the default disk does NOT have to be that of the file.
 
 
3 Auxiliary_Commands_and_Utilities
  Auxiliary Commands
 
  It is possible to exempt a process from EACF/DPS/HSM functions with
  the JTEXEMPT command, or to exempt the process from special functions
  on delete access with the JTEXEDEL command.
  The JTEXEMPT and JTEXEDEL commands can be enabled with the commands
 
  $ SET COMMAND GCY$SYS:JTEXEMPT
    or
  $ SET COMMAND GCY$SYS:JTEXEDEL
 
  These commands take the form
 
  $ JTEXEMPT[/NORMAL] jtan:
 
  where to exampt a process from having its access filtered by EACF/DPS/HSM
  one uses the command
 
  $ JTEXEMPT JTAn:
 
  which disables filtering for the disk associated with JTA pseudo unit n.
 
  To undo this exemption one uses the command
 
  $ JTEXEMPT/NORMAL JTAn:
 
  Note that no more than 4 processes may be on the exempt list at any time
  for these programs. JTEXEMPT operates on all functions. JTEXEDEL only
  prevents deletion protection from working (and removes deletion protection
  that EACF offers for the process also). A total of 4 processes can be
  using JTEXEDEL exemption in addition to 4 using JTEXEMPT protection.
 
  Note that a loop using F$DEVICE to find all online JTA units can be used
  to "globally" exempt all disks from filtering, or to "globally" remove
  this exemption.
 
  These functions are intended to be used sparingly or not at all, but are
  provided for such emergency access as may be needed. The functions require
  that the process posess CMKRNL privilege and the images should be
  guarded so that random intruders cannot easily use them to bypass EACF
  or other protections. (Note that EACF can be used for this protection
  if you wish.)
 
 
  It is possible to manually set or remove softlinks also. The SDH_LOGIN
  command file set up by combined setup defines the SOFTLINK verb which
  can be used from command line like this:
 
  $ SOFTLINK/TO:DEVICE:[DIR]FILE.TYPE SRCDVC:[SRCDIR]SRCFILE.SRCTYP
 
    creates a softlink where the (possibly empty) file
  SRCDVC:[SRCDIR]SRCFILE.SRCTYP has a link which "points to"
  DEVICE:[DIR]FILE.TYPE. Thus when anything tries to open the
  file SRCDVC:[SRCDIR]SRCFILE.SRCTYP, it in fact opens
  DEVICE:[DIR]FILE.TYPE. This soft link can cross device boundaries
  but must be a disk file. Also Safety must control both disks if
  the link is to be cleaned up correctly.
 
  The softlink can be removed with the command
 
  $ SOFTLINK/REMOVE SRCDVC:[SRCDIR]SRCFILE.SRCTYP
 
  to pull the softlink off.
 
  Minor mods to the JT_SOFTLINK procedure (replacing the "H<" strings by
  "#<" would create a command file which would create or delete read-only
  softlinks.
 
 
4 JTDELMAINT
 
  There are two commands to control JTDELMAINT which is used to undelete
  user files or to finally "empty the wastebasket" of files deleted
  over N seconds ago.
 
  JTDEMAINT file/%UNDEL  undeletes "file". Note that "File" is a string
         here which matches the full pathname of the original deleted
         file. The file is restored to its original location. (In rename
         or command file handled delete protection, ownership is as
         before. In copy mode, undelete should be done by systems privileged
         users only to restore ownership to the directory containing the
         file.)
 
  JTDELMAINT file/%PURGE:nnnnn
         finally removes all files deleted more than nnnnn seconds ago (before
         the present time). A periodic batch job normally runs this command
         once a day. (File is not really needed here.)
 
  The utility uses the JTDEL$MODE logical to maintain some mode settings
  about how to handle deletion; this is set up by the Safety setup
  script at startup of Safety. The mode bits are:
 
   Bit   Meaning
   0-1   0 = use .COM file
         1 = use rename mode
         2 = use copy (callable cvt) mode
         3 = copy and add softlink. No database file genn'd
   2     If set don't delete ANYthing immediately
   3     If set don't include only included names
   4     If set, delete file if no room for rename/copy
         If clear, leave file alone if copy area is full (return error though)
   5     If set, no timetag on deleted files (use if using softlink...)
   6     If set, call backup cmd file before cleanup; pass it nnnnnnn
 
  The command file GCY$CM:DELBAK.COM is passed the "nnnnn" value and called
  run if bit 6 of JTDEL$MODE is set.
