Default Job and Variable Modes for Xi-Batch Users

Xi-BatchXi-Batchconfigurationpermissionsbtuchangebtuser

A new job or variable is created with its owner's default modes. This article says what those defaults hold, what Xi-Batch ships them as, and how to change them for one user or for the whole site. What the individual permissions mean, how the three sets are combined when a permission is tested, and how to change the modes on a job or variable that already exists are covered in Modes on Xi-Batch Jobs and Variables.

Where the defaults are held

Each user has two sets of default modes - one for jobs, one for variables - and each set has three parts, for user, group and other. They are stored in the Xi-Batch user file alongside the user's privileges, priorities and load levels. A user with no entry of their own takes the defaults from the default record, so changing that record changes at once every user who has never been given settings of their own.

The modes are copied into the job or variable at creation, and the object carries its own copy from then on. A user whose settings come to match the defaults exactly loses their individual entry and reads the same values from the default record.

The eleven permissions

For jobs - all eleven permissions:

• Read, Write, Reveal
• Display mode, Set mode
• Assume ownership, Assume group ownership
• Give away owner, Give away group
• Delete, Kill

For variables - the same ten, without Kill.

Each is held separately for User (the owner), Group (the owner's primary group) and Other (everybody).

The modes Xi-Batch ships with

These are the values written into the default record when the user file is created:

Permission	Job: User	Job: Group	Job: Other	Var: User	Var: Group	Var: Other
Read	Yes	Yes	No	Yes	Yes	No
Write	Yes	No	No	Yes	No	No
Reveal	Yes	Yes	Yes	Yes	Yes	Yes
Display mode	Yes	Yes	Yes	Yes	Yes	Yes
Set mode	Yes	No	No	Yes	No	No
Assume ownership	No	No	No	No	No	No
Assume group ownership	No	No	No	No	No	No
Give away owner	Yes	No	No	Yes	No	No
Give away group	Yes	Yes	No	Yes	Yes	No
Delete	Yes	No	No	Yes	No	No
Kill	Yes	No	No	n/a	n/a	n/a

Assume ownership is off in all six sets, so a transfer of ownership cannot be completed until somebody turns it on, and an account that has it off can have no job pushed onto it.

Display mode is on in all six sets. A user who is refused access can see the reason only where it is set.

Reading the current defaults

Your own:

btuser -d

Prints your job and variable default modes, by permission and by set, together with your priorities, load levels and privileges. No privilege is required.

All users (requires the read admin file privilege):

# %j is the job default mode, %v the variable default mode
btulist -H -F "%u %j %v"

Each is printed as three letter strings:

U:RWSMPUGDK,G:RSMG,O:SM

The letters are R read, W write, S reveal, M display mode, P set mode, U give away owner, V assume ownership, G give away group, H assume group ownership, D delete, K kill. The listing opens with a DEFAULT line showing the modes inherited by users with no entry of their own.

The same information is on the btuser -v screen: move to the user and press c for their default modes, or C for the defaults.

Changing your own defaults

Requires: change default modes (Cdft) privilege, which is granted by default

btuser -m

This opens the mode editor on your own defaults. The screen shows both blocks side by side, Jobs on the left and Vars on the right, each with User, Group and Other columns:

1. Move down the permission list with j and k, and across the columns with h and l - the cursor runs off the right of the Jobs block into the Vars block. J jumps to the Jobs block and V to the Vars block.
2. For each cell:
   • Y, y, T or t to set
   • N, n, F or f to unset
   • ~ or ! to invert
3. D discards the lot and restores all six mode words to the system defaults
4. Press q to leave the screen and save

Some permissions move together as you edit: setting Read also sets Reveal, setting Write also sets Read and Reveal, setting Set mode also sets Display mode, and clearing Reveal clears Read and Write with it.

Without the Cdft privilege btuser -m refuses to start.

Setting another user's defaults

Requires: write admin file privilege

# Job modes for two users
btuchange -u -J "U:RWSMPDK,G:RSM,O:" jsmith mjones

# Variable modes for the same users
btuchange -u -V "U:RWSMPD,G:RSM,O:" jsmith mjones

# Both at once
btuchange -u -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S" jsmith

-J sets the job default mode and -V the variable default mode. -u takes no value; the user names follow the options, and omitting them applies the change to every user.

The mode string is the same syntax used everywhere else in Xi-Batch: comma-separated clauses, each an optional U, G or O selector followed by a colon, then = (or nothing) to set, + to add or - to remove, then the permission letters. The letters are upper case only.

# Add group read to everyone's job defaults, changing nothing else
btuchange -u -J "G:+RS"

# Take reveal away from other, for one user
btuchange -u -J "O:-S" -V "O:-S" jsmith

Interactively, in btuser -i, move to the user and press c to edit their default modes; the editor is the one described above.

Setting the system default record

Requires: write admin file privilege

The default record is what every user without an entry of their own is running on, so this is usually the setting to change. It stays visible on the DEFAULT line of the listing.

# Change the default record only
btuchange -D -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S"

# Change it and copy the whole default record over every user
btuchange -D -A -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S"

-D edits the default record and cannot be combined with user names. -A overwrites every user's default modes and their privileges, priorities and load levels with the defaults.

Interactively, press C on the btuser -i screen to edit the default modes. On leaving the editor btuser asks:

Copy to everyone else (but you)?

Answer Y to write the modes you have just set over every other user's, or N to leave existing users alone.

Mode strings for three site policies

Private by default

btuchange -D -J "U:RWSMPDK,G:,O:S" -V "U:RWSMPD,G:,O:S"

The group loses everything; other keeps Reveal so jobs still appear in the queue listing. Clearing Reveal for other as well makes a job invisible to everyone outside the owner's group, including to an administrator working without the write admin file privilege.

Shared team work

btuchange -u -J "U:RWSMPDK,G:RWSMPDK,O:S" -V "U:RWSMPD,G:RWSMPD,O:S" alice bob charlie

Everyone in the group has the owner's rights over anything the group owns. The same effect for all of a user's access at once is the UG privilege, described in Understanding User Privileges and Access Control - grant one or the other.

Public status variables

btuchange -u -V "U:RWSMPD,G:RSM,O:RSM" monitor

Variables created by the monitoring account are readable by everyone, so other people's jobs can test them in conditions.

Giving a new object different modes

A user with the Cdft privilege can give a new job or variable different modes as they create it:

# A job
btr -M "U:RWSMPDK,G:RSM,O:S" backup.sh

# A variable
btvar -C -M "U:RWSMPD,G:RSM,O:S" -s Pending backup_status

Without Cdft, supplying modes that differ from the user's defaults is refused, and creation with no -M continues to work.

Checking the change took

Run btuser -d from the user's own account. It shows the defaults they are now creating jobs with.

Before changing the defaults for a whole site, create one job on the new settings and read its mode back with btjlist -H -F "%N %M".

Related articles

All articles · Release notes · Contact support