mkpolicy
Creates or updates a policy
Applicability
Product |
Command type |
---|---|
VersionVault |
cleartool subcommand |
Platform |
---|
UNIX® |
Linux® |
Windows® |
Synopsis
- mkpolicy [ -replace ]
- [ -set policy-file-pname ]
Description
The mkpolicy command creates or updates a policy. Policies have an Access Control List (ACL) for each controlled VOB metatype (such as UCM project, branch type, and element). The access control entries (ACEs) in a policy list a principal and the permissions that are granted to it. Principals in a policy are usually roles, with the name of the role defined by the administrator. You can also specify users or groups in a policy, but most administrators prefer to specify such identities in the rolemaps that implement the policy.
Restrictions
Authorization
- mkpolicy: read-info on VOB object, mkpolicy on VOB
- mkpolicy -replace: read-info on VOB object, mod-props on policy
Locks
An error occurs if the VOB object is locked.
Mastership
(Replicated VOBs) No mastership restrictions.
Options and arguments
Specifying the policy
- -set policy-file-pname
- Specify a file containing one or more sections, each labeled with
a meta-type name and containing a list of principals and roles, along
with their respective permissions.
- The possible section names are: VOB, policy, rolemap, element.
- For the VOB section, the possible permissions are: read-info, read-name, mod-props, chmaster, mkpolicy, mkrolemap, rmelem, lock, mod-hlink, mod-attr.
- For the policy section, the possible permissions are: read-info, read-name, mod-props, chmaster, lock, mod-hlink, mod-attr.
- For the rolemap section, the possible permissions are: read-info, read-name, mod-props, chmaster, lock, mod-hlink, mod-attr.
- For the element section, the possible permissions are: read-info, mod-props, chmaster, mod-checkout, rmver, mod-branch, mod-label, write-dir, lookup-dir, lock, mod-task, mod-hlink, mod-attr, mod-trig.
- policy-file-pname
- The full path to a file containing the sections and permissions. Each section must be delineated
with a [section] line. Each entry in the section must be formatted as
identity_type:[identity] permission,[...,]
For example, a sample file perms.acl could contain:[vob] User:NTDOMAIN\administrator read-name,read-info,mkpolicy Group:NTDOMAIN\users read-name,read-info Role:Developer read-name,read-info Owner-User: Full Owner-Group: Full Everyone: Read [element] Owner-User: Full Owner-Group: Full Role:Developer Read,mod-checkout Role:ProjectLead Read,mod-checkout,rmver Everyone: Read
- -rolemap controlling-rolemap-selector
- The controlling rolemap that protects the policy; the controlling rolemap defines principals who may read or modify the policy.
- policy-selector
- The name or list of names for the policy that is about to be created; or, if used with -replace, the policy name of the existing policy that is to be redefined.
Updating a policy
- -replace
- Replaces the policy for the current policy-selector with the new permissions defined in policy-file-pname.
Event records and comments
- Default
- Creates one or more event records, with commenting controlled by your .versionvault_profile file (default: -cqe). See the comments reference page. Comments can be edited with chevent.
- -c/omment comment | -cfi/le comment-file-pname |-cq/uery | -cqe/ach | -nc/omment
- Overrides the default with the option you specify. See the comments reference page.
Examples
The UNIX system and Linux examples in this section are written for use in csh. If you use another shell, you may need to use different quoting and escaping conventions.
The Windows examples that include wildcards or quoting are written for use in cleartool interactive mode. If you use cleartool single-command mode, you may need to change the wildcards and quoting to make your command interpreter process the command appropriately.
In cleartool single-command mode, cmd-context represents the UNIX system and Linux shells or Windows command interpreter prompt, followed by the cleartool command. In cleartool interactive mode, cmd-context represents the interactive cleartool prompt.
- Create a policy for VOBs and elements.
cmd-context cleartool mkpolicy -set perms.acl -c "Creating new Policy" DevPolicy