Default Job and Variable Modes for Xi-Batch Users

Understanding Default Modes

When a user creates a job or a variable, it is given that user's default modes. Those are the initial permissions on the new object, and from that moment the object carries its own copy of them.

Each user has two sets of default modes - one for jobs, one for variables - and each set has three parts, for user, group and other. They are stored in the Xi-Batch user file alongside the user's privileges, priorities and load levels. A user with no entry of their own takes the defaults from the default record, so changing that record changes every user who has never been given settings of their own.

What the individual permissions mean, how the three sets are combined when a permission is tested, and how to change the modes on a job or variable that already exists are covered in Modes on Xi-Batch Jobs and Variables. This article covers the per-user defaults only.

What a Default Mode Contains

For jobs - all eleven permissions:

• Read, Write, Reveal
• Display mode, Set mode
• Assume ownership, Assume group ownership
• Give away owner, Give away group
• Delete, Kill

For variables - the same ten, without Kill.

Each is held separately for User (the owner), Group (the owner's primary group) and Other (everybody).

The Modes Xi-Batch Ships With

These are the values written into the default record when the user file is created, and they are what a user gets if nobody has changed anything:

In short: the owner has full control, the owner's group can read it and see who owns it, and everybody else can see that it exists and inspect its permissions. Note that Assume ownership is off everywhere, so a transfer of ownership cannot be completed until somebody turns it on.

Viewing Default Modes

Your own:

btuser -d

Prints your job and variable default modes, by permission and by set, together with your priorities, load levels and privileges. No privilege is required.

All users (requires the read admin file privilege):

# %j is the job default mode, %v the variable default mode
btulist -H -F "%u %j %v"

Each is printed as three letter strings:

U:RWSMPUGDK,G:RSMG,O:SM

The letters are R read, W write, S reveal, M display mode, P set mode, U give away owner, V assume ownership, G give away group, H assume group ownership, D delete, K kill. The listing opens with a DEFAULT line showing the modes inherited by users with no entry of their own.

The same information is on the btuser -v screen: move to the user and press c for their default modes, or C for the defaults.

Changing Your Own Default Modes

Requires: change default modes (Cdft) privilege, which is granted by default

btuser -m

This opens the mode editor on your own defaults. The screen shows both blocks side by side, Jobs on the left and Vars on the right, each with User, Group and Other columns:

1. Move down the permission list with j and k, and across the columns with h and l - the cursor runs off the right of the Jobs block into the Vars block. J jumps to the Jobs block and V to the Vars block.
2. For each cell:
   • Y, y, T or t to set
   • N, n, F or f to unset
   • ~ or ! to invert
3. D discards the lot and restores all six mode words to the system defaults
4. Press q to leave the screen and save

Some permissions move together as you edit: setting Read also sets Reveal, setting Write also sets Read and Reveal, setting Set mode also sets Display mode, and clearing Reveal clears Read and Write with it.

Without the Cdft privilege btuser -m refuses to start, and the same privilege is what allows a user to give a new job or variable modes other than these defaults.

Setting Another User's Default Modes

Requires: write admin file privilege

# Job modes for two users
btuchange -u -J "U:RWSMPDK,G:RSM,O:" jsmith mjones

# Variable modes for the same users
btuchange -u -V "U:RWSMPD,G:RSM,O:" jsmith mjones

# Both at once
btuchange -u -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S" jsmith

-J sets the job default mode and -V the variable default mode. -u takes no value; the user names follow the options, and omitting them applies the change to every user.

The mode string is the same syntax used everywhere else in Xi-Batch: comma-separated clauses, each an optional U, G or O selector followed by a colon, then = (or nothing) to set, + to add or - to remove, then the permission letters. The letters are upper case only.

# Add group read to everyone's job defaults, changing nothing else
btuchange -u -J "G:+RS"

# Take reveal away from other, for one user
btuchange -u -J "O:-S" -V "O:-S" jsmith

Interactively, in btuser -i, move to the user and press c to edit their default modes; the editor is the one described above.

Setting the System Default Modes

Requires: write admin file privilege

The default record is what every user without an entry of their own is running on, so this is usually the setting to change.

# Change the default record only
btuchange -D -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S"

# Change it and copy the whole default record over every user
btuchange -D -A -J "U:RWSMPDK,G:RSM,O:S" -V "U:RWSMPD,G:RSM,O:S"

-D edits the default record and cannot be combined with user names. -A overwrites every user's default modes and their privileges, priorities and load levels with the defaults - it is not confined to the modes.

Interactively, press C on the btuser -i screen to edit the default modes. On leaving the editor btuser asks:

Copy to everyone else (but you)?

Answer Y to write the modes you have just set over every other user's, or N to leave existing users alone.

Common Patterns

Private by default

btuchange -D -J "U:RWSMPDK,G:,O:S" -V "U:RWSMPD,G:,O:S"

The group loses everything; other keeps Reveal so jobs still appear in the queue listing. Suits a site where users share a machine but not their work.

Shared team work

btuchange -u -J "U:RWSMPDK,G:RWSMPDK,O:S" -V "U:RWSMPD,G:RWSMPD,O:S" alice bob charlie

Everyone in the group has the owner's rights over anything the group owns. The same effect for all of a user's access at once is the UG privilege, described in Understanding User Privileges and Access Control - grant one or the other, not both.

Public status variables

btuchange -u -V "U:RWSMPD,G:RSM,O:RSM" monitor

Variables created by the monitoring account are readable by everyone, so other people's jobs can test them in conditions.

What a Change Does and Does Not Affect

Existing jobs and variables keep the modes they were created with. A default mode is copied into the object at creation and is never consulted again. To change objects that already exist, change their modes directly - see Modes on Xi-Batch Jobs and Variables.

A user without an entry of their own follows the default record. Changing the default record moves them at once; it does not wait for a new account.

A user whose settings match the defaults exactly loses their individual entry. This is bookkeeping rather than a behaviour change: they continue to read the same values, from the default record instead of their own.

Overriding the Default at Creation

A user with the Cdft privilege can give a new job or variable different modes as they create it:

# A job
btr -M "U:RWSMPDK,G:RSM,O:S" backup.sh

# A variable
btvar -C -M "U:RWSMPD,G:RSM,O:S" -s Pending backup_status

Without Cdft, supplying modes that differ from the user's defaults is refused, and creation with no -M continues to work.

Good Practice

Change the default record, not every user. Most users have no entry of their own, so one change covers them, and the setting stays visible on the DEFAULT line.

Keep Reveal for other unless you mean to hide things. Clearing it makes jobs invisible to everyone outside the owner's group, including to an administrator working without the write admin file privilege.

Leave Display mode on. Without it a user who is refused access cannot see why, and the support call is unavoidable.

Turn Assume ownership on only where transfers happen. It is off in the shipped defaults, and that is what stops jobs being pushed onto an account.

Verify as the user. btuser -d from their account shows the defaults they are actually creating jobs with.

Test with one job. Create a job and read its mode back with btjlist -H -F "%N %M" before changing the defaults for a whole site.