IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
structure, the rights are inherited from this position in the tree. There is an
exception to this: rights which are allocated selectively to object properties
(Selected Properties) are not inherited.
Example 1:
SYS: RZenk [Read; File Scan]
PUBLIC
NWADMIN.EXE
NDIR.EXE
If the user RZenk is granted [Read; File Scan] rights to the SYS: volume,
these rights are in this case also inherited to the PUBLIC directory and the
NWADMIN.EXE and NDIR.EXE files contained in PUBLIC. It is also possible
to restrict the inheritance of certain rights. This is done using the Inherited
Rights Filters (IRF), which are discussed below. In the basic state, no rights
are filtered. There is another mechanism which prevents inheritance. If the
same NDS object is assigned the same right again further down in the tree, the
original rights that the object received further up in the tree are no longer
inherited from this point.
Example 2:
SYS: RZenk [Read; File Scan]
PUBLIC
NWADMIN.EXE RZenk [Write]
NDIR.EXE
In example 2, the user RZenk only has the right [Write] for the file
NWADMIN.EXE as the rights [Read; File Scan] of the user RZenk are not
inherited to the file NWADMIN.EXE. All other NDS objects which may have
received rights to the file NWADMIN.EXE are not affected by this. Even the
rights which the user RZenk receives for the file NWADMIN.EXE via other
mechanisms, such as groups, containers, etc., are not restricted by this. These
rights are, therefore, additive.
Inherited Rights Filters (IRF)
While trustee assignments grant access to an object, an object property, a file or
a directory, an IRF prevents rights being inherited from an object, an object
property, a file or a directory to other NDS objects, files or directories in the
tree. Each object, object property, file and directory in an NDS directory or file
system can have a different IRF.
The only difference between the NDS and the file system concerns the right
Supervisor. This right can only be filtered in the NDS. In the file system, on the
other hand, this right can no longer be filtered once it has been assigned.
Effective rights
The combination of an Inherited Rights Filter, Trustee Assignment and Security
Equivalences is called effective rights (ER). The effective rights which an NDS
object has to another NDS object or its property, as well as the effective rights
which an NDS object has to the file system, can be specified with the program
Netware Administrator (see also previous diagrams).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000