HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

Table 6-3 Compartment Manpages (continued)
DescriptionManpage
Describes the HP-UX compartments files.compartments(4)
Extended authentication, account, password, and session service module
for HP-UX.
pam_hpsec(5)
6.4 Compartment Rules and Syntax
A compartment consists of a name and a set of rules. This section describes the four
types of compartment rules:
• File system rules
• IPC rules
• Network rules
• Miscellaneous rules
Add rules to a rules file you create in the /etc/cmpt directory. You can edit this file
using vi or a similar text editor. The rules file must have a .rules extension.
See compartments(5) for additional information.
6.4.1 Compartment Definition
Define compartments by configuring a name for each compartment, and associating
one or more compartment rules with the compartment name. You can specify rules in
any order.
The syntax for a compartment definition is as follows:
[sealed] [discover] compartment new_compartment_name { rules }
where:
sealed
(Optional) A process in this compartment cannot gain
privileges or change compartments by calling execve.
discover
(Optional) Discover and automatically add rules so
that compartment violations are overridden. This is a
development feature to determine the rules necessary,
and should not be used on a production system. See
Section 6.7 for more information on this keyword.
compartment
Designates that the rule is a compartment definition.
new_compartment_name
The label associated with the new compartment. This
label is case sensitive. For example, compartmenta
and CompartmentA are different compartments.
{}
Enclose the rules for this compartment.
For example:
114 Compartments