All users with execute access to the main application image
of the subsystem can use the data files and other objects under
control of the subsystem if the subsystem allows the access. However,
managers of the subsystem can restrict access to objects of the
subsystem in the following ways:
They can create special identifiers for resources belonging
to the subsystem that they do not want all members to access and
add ACEs to these resources.
They can use compound expressions in ACEs and thus
grant access conditionally. For example, the following ACE grants
access to MEMBERS_ADMIN when running MEMBERS_SUBSYSTEM but not to MEMBERS_ADMIN
alone nor to other users holding the MEMBERS_SUBSYSTEM identifier: (ID=MEMBERS_SUBSYSTEM+MEMBERS_ADMIN, ACCESS=READ+WRITE)
Remember that as long as users are executing the application
image for the subsystem, their process rights list contains the
subsystem identifier as well as their normal identifiers. However,
as soon as users interrupt or exit from the application, their process
rights list loses the subsystem identifier, and they lose access
rights to the objects in the subsystem. Subsystem identifiers are
not propagated by default when subprocesses are spawned.
HP OpenVMS Guide to System Security
Security for the System Administrator
