(IRF) A list of rights created for every file, directory, and object. The IRF controls the rights that a trustee can inherit from parent directories and container objects.

By default, the IRF allows every right to be inherited from the parent directory or container object. The IRF cannot grant rights, it can only allow or revoke rights.

To allow a right, the right must exist in the parent directory or container object and the IRF.

To revoke a right, the right must exist in the parent directory or container object and then be removed from the IRF.

The IRF is ignored whenever a trustee has an explicit trustee assignment to that file, directory, or object.

Figure 39
Inherited Rights Filter

Because Nick has an explicit trustee assignment to SALES, the IRF for SALES has no affect on his rights.

The IRF for MANAGERS allows all rights to pass through, so Nick's rights to MANAGERS are the same as his rights to SALES.

However, the IRFs for SPREADSHEET and ACCOUNTING block rights from SALES, so Nick doesn't have the same rights for those objects.

If Nick is granted an explicit trustee assignment to any objects below SALES, the IRF for those objects is ignored and his new assignment determines his effective rights.

Figure 40
Effective Rights Chart

The IRF of an object and its properties can block the Supervisor object right. This allows distributed management of the Directory tree.

However, NetWare utilities don't allow you to block the Supervisor object right unless an object, including itself, is already granted the Supervisor right to that object. This helps to prevent cutting off Supervisor-level access to a part of the Directory tree.

WARNING:  Any object can be assigned as a trustee to an object, including to itself. But unless the trustee assignment is a User object, blocking the Supervisor object right with the IRF still cuts off that object from future control because you can only log in as a User object.

Because the Supervisor right to objects and properties can be blocked, you should also grant a trustee all other rights.

For example, don't grant only the Supervisor right. Even though that right allows or implies all rights to an object, if the Supervisor right is blocked, the trustee is left with no rights.

Instead, grant all rights to the trustees, so that if Supervisor is blocked by an IRF, the trustee still has Browse, Rename, Create, and Delete rights.

To change the IRF of an object, you must have at least the Write property right to the ACL property of that object.

As with previous versions of NetWare, the Supervisor right cannot be blocked in the file system. A trustee who has the Supervisor right in the root directory of a volume has the Supervisor right to the entire volume, and it cannot be blocked with an IRF.

Changing the IRF

The IRF for any file, directory, or object is part of the access control list (ACL) for that file, directory, or object.

To change the IRF of an object, you must have at least the Write property right to the ACL property of that object.

To change the IRF of a file or directory, you must have the Access Control right to that file or directory.