mkpolicy

Creates or updates a policy

Applicability


Product	Command type
VersionVault	cleartool subcommand


Platform
UNIX®
Linux®
Windows®

Synopsis

mkpolicy [ -replace ]: [ -set policy-file-pname ]; [ -rolemap controlling-rolemap-selector ]; [ -c/omment comment | -cfi/lepname | -cq/uery | -cqe/ach | -nc/omment ]; policy-selector ...

Description

The mkpolicy command creates or updates a policy. Policies have an Access Control List (ACL) for each controlled VOB metatype (such as UCM project, branch type, and element). The access control entries (ACEs) in a policy list a principal and the permissions that are granted to it. Principals in a policy are usually roles, with the name of the role defined by the administrator. You can also specify users or groups in a policy, but most administrators prefer to specify such identities in the rolemaps that implement the policy.

Restrictions

Authorization

The principal must have the following permissions:

mkpolicy: read-info on VOB object, mkpolicy on VOB
mkpolicy -replace: read-info on VOB object, mod-props on policy

Locks

An error occurs if the VOB object is locked.

Mastership

(Replicated VOBs) No mastership restrictions.

Options and arguments

Specifying the policy

-set policy-file-pname

Specify a file containing one or more sections, each labeled with a meta-type name and containing a list of principals and roles, along with their respective permissions.

The possible section names are: VOB, policy, rolemap, element.
For the VOB section, the possible permissions are: read-info, read-name, mod-props, chmaster, mkpolicy, mkrolemap, rmelem, lock, mod-hlink, mod-attr.
For the policy section, the possible permissions are: read-info, read-name, mod-props, chmaster, lock, mod-hlink, mod-attr.
For the rolemap section, the possible permissions are: read-info, read-name, mod-props, chmaster, lock, mod-hlink, mod-attr.
For the element section, the possible permissions are: read-info, mod-props, chmaster, mod-checkout, rmver, mod-branch, mod-label, write-dir, lookup-dir, lock, mod-task, mod-hlink, mod-attr, mod-trig.

policy-file-pname

The full path to a file containing the sections and permissions. Each section must be delineated with a [section] line. Each entry in the section must be formatted as

identity_type:[identity] permission,[...,]

For example, a sample file perms.acl could contain:

[vob]
User:NTDOMAIN\administrator read-name,read-info,mkpolicy
Group:NTDOMAIN\users read-name,read-info
Role:Developer read-name,read-info
Owner-User: Full
Owner-Group: Full
Everyone: Read

[element]
Owner-User: Full
Owner-Group: Full
Role:Developer Read,mod-checkout
Role:ProjectLead Read,mod-checkout,rmver
Everyone: Read

-rolemap controlling-rolemap-selector: The controlling rolemap that protects the policy; the controlling rolemap defines principals who may read or modify the policy.

policy-selector: The name or list of names for the policy that is about to be created; or, if used with -replace, the policy name of the existing policy that is to be redefined.

Updating a policy

-replace: Replaces the policy for the current policy-selector with the new permissions defined in policy-file-pname.

Event records and comments

Default: Creates one or more event records, with commenting controlled by your .versionvault_profile file (default: -cqe). See the comments reference page. Comments can be edited with chevent.
-c/omment comment | -cfi/le comment-file-pname |-cq/uery | -cqe/ach | -nc/omment: Overrides the default with the option you specify. See the comments reference page.

Examples

The UNIX system and Linux examples in this section are written for use in csh. If you use another shell, you may need to use different quoting and escaping conventions.

The Windows examples that include wildcards or quoting are written for use in cleartool interactive mode. If you use cleartool single-command mode, you may need to change the wildcards and quoting to make your command interpreter process the command appropriately.

In cleartool single-command mode, cmd-context represents the UNIX system and Linux shells or Windows command interpreter prompt, followed by the cleartool command. In cleartool interactive mode, cmd-context represents the interactive cleartool prompt.

Create a policy for VOBs and elements.
cmd-context cleartool mkpolicy -set perms.acl -c "Creating new Policy" DevPolicy