HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

TIP: Keep the backup files; this makes it easier to revert to a prior configuration.
6.5.2 Defining a Compartment Configuration
You can create new compartments and modify existing compartments without rebooting
the system. If you enable or disable the compartment feature, or completely remove a
compartment, you must reboot the system. However, if you remove all rules associated
with a compartment and all references to that compartment, you can leave the
compartment on the system until the next reboot.
See Section 6.5.2.2 for more information about the implications of changing the name
of a compartment.
You can add new compartment rules, delete unneeded rules, and modify existing rules.
You can also change the names of existing compartments.
The application containment wizard, contain, can be used to simplify this
configuration process. See compartment_login(5) for more information.
To following sections describe how to modify compartment configuration.
6.5.2.1 Changing Compartment Rules
1. (Optional) Make temporary backup copies of the configuration files you plan to
modify. Either put these files outside the /etc/cmpt directory or omit the .rules
suffix. Doing this lets you easily revert to the starting point if an editing problem
occurs.
2. Use the following command to examine the current compartment rules:
# getrules
3. Create or modify compartment rules. See Section 6.4 for instructions on completing
this step and for a complete description of compartment rules syntax.
4. (Optional) Preview the compartment rules by entering the following command:
# setrules -p
The -p option parses the configured rules list and reports any discrepancies in
syntax and semantics. HP recommends that you follow this step before enabling
compartment rules on the system.
5. (Optional) Make backup copies of the compartment configuration files.
6. Run the setrules command to load the configured rules:
# setrules
6.5.2.2 Changing Compartment Names
You can change the names of compartments. However, changing the name of a
compartment can affect applications that are already configured with the existing
122 Compartments