Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
HP-UX Reference > C

cmdprivadm(1M)

HP-UX 11i Version 3: February 2007
» 

Technical documentation

» Feedback
Content starts here

 » Table of Contents

 » Index

NAME

cmdprivadm — noninteractive editing of a command's authorization and privilege information in the privrun database

SYNOPSIS

cmdprivadm add option=value [option=value]...

cmdprivadm delete option=value [option=value]...

DESCRIPTION

cmdprivadm is a noninteractive command that allows user with appropriate permission to add or delete a command and its privileges in the Role-Base Access Control (RBAC) database, /etc/rbac/cmd_priv. See privrun(1M) for more details on this file.

When adding a line to the database, cmdprivadm sets fields that are not specified a default value. When deleting a line, the lines matching all the given option=value pairs will be deleted. That is, if all fields specified match, the entry will be deleted.

cmdprivadm add option=value [option=value]...

  • Appends a line as specified in option=value pairs in the /etc/rbac/cmd_priv file.

cmdprivadm delete option=value [option=value]...

  • Deletes a line as specified in option=value pairs from /etc/rbac/cmd_priv file.

HP recommends that only the authadm, cmdprivadm, and roleadm commands be used to edit and view the RBAC databases; do not edit the RBAC files directly.

See rbac(5) for information on the RBAC databases.

Options

The following options are valid option=value pairs for cmdprivadm.

cmd=command

command should include the full path name of the command. There can be one or more arguments following the command.

file=filename

filename should specify the full path name of a file name.

op=operation

Specifies the operation.

object=object

Specifies the object.

ruid=ruid

Specifies the real user ID (ruid).

euid=euid

Specifies the effective user ID (euid).

rgid=rgid

Specifies the real group ID (rgid).

egid=egid

Specifies the effective group ID (egid).

compartment=compartment_label

Specifies the compartment.

privs=comma_separated_privilege_list

Specifies the privileges.

re-auth=pam_service

Specifies the PAM service name to reauthenticate under. See pam.conf(4) for a list of PAM services.

flags=comma_separated_flags_list

Specifies the flags.

Note: You must enclose values that contain the space character, or any characters that may be interpreted by the shell, with single quotes. For example, if the cmd has one or more arguments, enclose them with single quotes:

cmd='mount -a'

Authorizations:

In order to invoke cmdprivadm, the user must either be root, (running with effective UID of 0), or have the appropriate authorizations. The following is a list of the required authorizations for running cmdprivadm with particular options:

hpux.security.access.privrun.add,*

Allows user to run cmdprivadm with add options.

hpux.security.access.privrun.delete,*

Allows user to run cmdprivadm with delete options.

EXTERNAL INFLUENCES

Environment Variables

LC_MESSAGES determines the language in which messages are displayed.

International Code Set Support

Single-byte character code set is supported.

RETURN VALUE

Upon completion, cmdprivadm returns one of the following values:

0

Success.

1

Failure. An appropriate error message is printed on standard error.

EXAMPLES

The following commands add entries into the /etc/rbac/cmd_priv file:

# cmdprivadm add cmd='/sbin/mount -a' op=hpux.adm.mount \ > object='*' ruid=0 euid=0 rgid=0 egid=0 compartment=testcomp \ > privs=BASICROOT,CHANGECMPT re-auth=passwd # cmdprivadm add cmd=/sbin/mount op=hpux.printer.add object='*'

The following commands delete entries from the /etc/rbac/cmd_priv file:

# cmdprivadm delete cmd='/sbin/mount -a' # cmdprivadm delete cmd=/sbin/mount

FILES

/etc/rbac/roles

Database containing valid definitions of all roles.

/etc/rbac/auths

Database containing definitions of all valid authorizations.

/etc/rbac/user_role

Database specifying the roles allowed for each specified user.

/etc/rbac/role_auth

Database defining the authorizations for each specified role.

/etc/rbac/cmd_priv

Database containing the authorization to execute specified commands, and the privileges to alter UID and GID for command execution.

Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© 1983-2007 Hewlett-Packard Development Company, L.P.