privedit.1m (2010 09)

p
privedit(1M) privedit(1M)
Field Description
command | file For
privedit, the fully qualified path of a file to edit. This field may contain
wildcards as defined in fnmatch (3C).
For
privrun, the fully qualified path of the command that is being wrapped to
provide additional privilege.
arguments Ignored. (Used only by
privrun.)
(operation ,object ) The operation the user is required to have on the object specified. Together, the
(operation ,object ) forms the authorization. operation must be fully qualified and
cannot contain a wild card (
*).
all in object requires that the user has the specified operation on all objects.
(Note: this is satisfied by a specification of
(operation ,*) in the
/etc/rbac/role_auth
database if RBAC is in use.)
This field may contain the keyword
dflt
instead of (operation ,object ), which
indicates that no access check is required and the file can be edited with privilege
by any user.
ruid
/euid/rgid/egid
Ignored. (Used only by privrun.)
compartment Ignored. (Used only by
privrun.)
privs Ignored. (Used only by
privrun for privileges .)
pam-service Reauthentication service. If specified, the user is required to reauthenticate. The
privedit command identifies itself to PAM as the service indicated in this field.
This allows the security officer to require an additional set of authentication/account
management restrictions for particular files for editing. See pam.conf (4) for a list of
PAM services.
The keyword
dflt must be used to indicate that no reauthorization is required.
flags Flag values can be specified to indicate whether or not
privedit can edit a file.
Additional flag values can be specified to indicate whether privrun can execute a
command. The specific values allowed are as follows:
edit The file can be both edited and executed. This is mainly intended
for scripts.
noexec The file cannot be executed. It can only be edited with privedit.
any other token or empty (nothing after the last ":")
The file is a command that can be executed only. It cannot be
edited.
The Authorization field can contain the keyword
dflt instead of (operation ,object ), which indicates
that no access check is required and the command is invoked with privilege for any user. The UID and
GID entry in field 4 is ignored by privedit, but the slash character (/) separating the IDs must
remain. The pam service name in field 7 may also be dflt, which indicates reauthentication is not
required.
White space between each field (immediately surrounding the field separator
:) in this database is
optional and ignored by privedit.
There may be multiple entries with the same file line (but different authorization required). privedit
evaluates each entry in the order specified in the file, continuing on to the next only if the user does not
have the required authorization. The privedit -a command option described above allows users to
identify a specific authorization to match or find when multiple entries for the same file exist in the
cmd_priv database.
EXTERNAL INFLUENCES
Environment Variables
EDITOR specifies the default editor.
LC_MESSAGES determines the language in which messages are displayed.
2 Hewlett-Packard Company − 2 − HP-UX 11i Version 3: September 2010