libwliapi.3 (2011 03)

libwliapi(3)
Optional WLI Product Required
libwliapi(3)
NAME
libwliapi - WLI library functions for managing file access policies
SYNOPSIS
cc -I/opt/wli/include -L/opt/wli/lib -lwliapi
[flag...] file...
#include <wli.h>
wliapi_err_t wli_add_fap(const char *
filename , wli_fap_t policy_type );
wliapi_err_t wli_del_fap(const char *
filename , wli_fap_t
policy_type );
wliapi_err_t wli_check_fap(const char *
filename
, wli_fap_t policy_type ,
wliapi_rwmode_t
rw);
DESCRIPTION
The libwliapi shared library provides programmable interfaces to create, modify, delete and query
WLI file access policies on a regular file. A WLI policy restricts access to a file through either
or both of two policy types:
•
file lock access control (FLAC) - When a FLAC policy is assigned to a file, it cannot be
modified, deleted or moved to a different location.
•
identity based access control (IBAC) - When an IBAC policy is assigned to a file, it can
only be opened through an authorized executable with a valid WLI signature. See wlisign (1) for
details on managing WLI signature metadata.
To create, update, or delete policies through
libwliapi functions, the following requirements are essen-
tial:
• The calling executable must be signed and have been granted
api capability. Refer to wlisign (1) for
details on signing executables and the
api capability.
• The public key extracted from the private key that signed the executable must have been authorized
as a WLI user or administrator key and granted
api capability. The public key is used to verify
authenticity of the calling executable’s WLI signature. See wlicert (1M) for details on authorizing pub-
lic keys.
• The effective user ID (EUID) of the calling executable must match the owner ID of filename .
See wli(5) for more information on HP-UX Whitelisting (WLI).
FUNCTION ARGUMENTS
There are two arguments for
libwliapi functions that require specific values to be assigned. The fol-
lowing enumerations in header file /opt/wli//include/wli.h
define these values:
The file access policy types for the policy_type argument are:
typedef enum {
WLIAPI_FAP_NONE = 0,
WLIAPI_FAP_FLAC,
WLIAPI_FAP_IBAC,
WLIAPI_FAP_FLAC_FPID,
WLIAPI_FAP_MAXTYPE = WLIAPI_FAP_FLAC_FPID
} wli_fap_t;
The mode values for the
wli_check_fap() rw argument are:
typedef enum {
WLIAPI_FREAD = FREAD,
WLIAPI_FWRITE = FWRITE,
WLIAPI_FRW = FREAD | FWRITE
} wliapi_rwmode_t;
FUNCTIONS
wli_add_fap() Allows an executable to create the policy of type policy_type for the regular file
given by filename . The calling executable is authenticated by verifying its sig-
nature, as described by wlisign (1).
When a file access policy is created, the owner is the effective user ID (EUID)
of the executing process. The file owner must be the same as the EUID when
HP-UX 11iv3: Sep 2010 Web Release − 1 − Hewlett-Packard Company 1