Manualshelf

privedit.1m (2011 03)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages
1234
p
privedit(1M) privedit(1M)
NAME
privedit - let authorized users edit files that are under access control
SYNOPSIS
privedit [-htxv][-a
authorization] file
DESCRIPTION
privedit allows authorized users to edit files that are otherwise restricted by permissions or access
control lists. Identify which file to edit by specifying the file name as an argument to the
privedit com-
mand. After you invoke the command,
privedit checks the
/etc/rbac/cmd_priv
database to
determine the authorization required to edit the file. If you have the necessary authorization,
privedit
invokes the specified editor to edit the file.
You can specify which editor
privedit
uses to edit the file by setting the EDITOR environment vari-
able. If you do not set the
EDITOR
variable, privedit uses the default editor, vi. You cannot pass
arguments to the editor via the
privedit
command line. However, the editor recognizes and supports
editor-specific environment variables if you set them before invoking privedit.
You can use a fully qualified file name as a
privedit argument to identify which file to edit. If you do
not use a fully qualified file name,
privedit adds the current working directory to the beginning of the
file name you specify. Regardless of how you specify the file to edit, all file names are fully qualified after
invoking
privedit. The privedit command also recognizes and supports files that are symbolic
links.
privedit can edit only one file at a time. If you specify multiple file names as
privedit arguments,
privedit edits the first file specified and ignores the subsequent file names.
The HP-UX RBAC feature also provides the ability to customize how
privedit and privrun check
user authorizations. (See privrun (1M).) The Access Control Policy Switch (ACPS) module of HP-UX
RBAC provides responses to applications that must make authorization decisions. The ACPS
configuration file,
acps.conf, controls which modules are consulted for making access decisions, the
sequence in which the modules are consulted, and the rules for combining module responses to return
results to applications. See acps.conf (4), acps (3) and rbac (5) for more information.
Options
privedit recognizes the following options:
-a authorization Match only those entries requiring the specified authorization. The specified
authorization must exactly match the authorization present in the
cmd_priv data-
base (that is, no wildcards allowed).
-h Print privedit usage or help.
-t Check to see if the user has the authorization to edit the file and inform the user of
the results.
-x If the authorization check fails, edit the file with the caller’s original privileges.
-v Invoke privedit in verbose mode.
Operands
privedit recognizes the following operands:
file File to edit.
The cmd_priv Database
As described in privrun (1M), the /etc/rbac/cmd_priv file contains information indicating which
authorizations are required to execute commands or edit files. You can also specify a PAM service name
in /etc/rbac/cmd_priv to indicate how privedit should identify itself to PAM if a user must be
reauthenticated.
The file contains any number of entries, where each entry is specified on a single line in the following for-
mat:
{command|file}
: arguments :(operation ,object ):ruid/euid/rgid/egid : compartment : privs :
pam-service : flags
These fields are defined as follows:
HP-UX 11i Version 3: March 2011 − 1 − Hewlett-Packard Company 1

Summary of content (4 pages)