HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

NOTE: For stricter security policies, configure network interfaces in separate
compartments from those assigned to processes. Define rules for network access for
each compartment accordingly. Equal compartments are always granted full access to
one another.
The network interface rule syntax is as follows:
compartment compartment_name {
interface interface_or_ip[,interface_or_ip][...]
}
where:
interface
Specifies that this is an interface definition.
interface_or_ip[,interface_or_ip][...] A comma-separated list of interface names, IP
address, or range of IP addresses. IP addresses
or ranges can be specified as IPv4 addresses or
IPv6 addresses with an optional mask.
For example:
compartment iface0 {
/* Define the compartment for the network interface lan0 */
interface lan0
/* All addresses in the range 192.168.0.0-192.168.0.255 */
interface 192.160.0.0/24
}
compartment other_ifaces {
/* Define the compartment for two of the other network interfaces */
interface lan1,lan5
Privilege Limitation Rules A privilege limitation rule controls privilege inheritance.
Any privilege named in a privilege limitation rule cannot be obtained when calling
execve(2).
The syntax for privilege limitation rules is:
disallowed privileges privilege[,privilege[...]]
where:
disallowed privileges
Specifies this as a privilege limitation rule.
privilege[,privilege[...]] A comma-separated list of privileges. You can
use the following additional keywords:
• all: disallows all privileges
• none: allows all privileges
• !: denotes except
For example:
/* Disallow all privileges except mount. */
disallowed privileges all,!mount
120 Compartments