HP b2600 Administration Manual page 148

<sitepolicy> lines are currently ignored. They are intended to specify the site policies used by the XC-
QUERY-SECURITY-1 authorization method.
<access rule> lines specify how the server should react to untrusted client requests that affect the X
Window property named <property/ar>. The rest of this section describes the interpretation of an access
rule.
For an <access rule> to apply to a given instance of <property/ar>, <property/ar> must be on a
window that is in the set of windows specified by <window>. If <window> is any, the rule applies to
<property/ar> on any window. If <window> is root, the rule applies to <property/ar> only on root
windows.
If <window> is required property, the following apply. If required property is a <property/rp>, the rule
applies when the <window> also has that <property/rp>, regardless of its value. If required property is
a <property with value>, <property/rpv > must also have the value specified by <string/rv>. In this
case, the property must have type STRING and format 8, and should contain one or more null-terminated
strings. If any of the strings match <string/rv>, the rule applies.
The definition of string matching is simple case-sensitive string comparison with one elaboration: the
occurence of the character '*' in <string/rv> is a wildcard meaning "any string." A <string/rv> can
contain multiple wildcards anywhere in the string. For example, "x*" matches strings that begin with x,
"*x" matches strings that end with x, "*x*" matches strings containing x, and "x*y*" matches strings
that start with x and subsequently contain y.
There may be multiple <access rule> lines for a given <property/ar>. The rules are tested in the order
that they appear in the file. The first rule that applies is used.
<perms> specify operations that untrusted clients may attempt, and the actions that the server should
take in response to those operations.
<operation> can be r (read), w (write), or d (delete). The following table shows how X Protocol
property requests map to these operations in The Open Group server implementation.
GetProperty
ChangeProperty
RotateProperties
DeleteProperty
ListProperties
<action> can be "a" (allow), "i" (ignore), or "e" (error). "Allow" means execute the request as if it had
been issued by a trusted client. "Ignore" means treat the request as a no-op. In the case of GetProperty,
ignore means return an empty property value if the property exists, regardless of its actual value. "Error"
means do not execute the request and return a BadAtom error with the atom set to the property name.
Error is the default action for all properties, including those not listed in the security policy file.
Page 148
r, or r and d if delete=True
w
r and w
d
none, untrusted clients can always list all properties
Graphics Administration Guide for HP-UX 10.20