privrun.1m (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

privrun(1M) privrun(1M)

NAME

privrun - invoke another application with privileges after performing appropriate authorization checks

and optionally reauthenticating the user

SYNOPSIS

privrun [-htx][-a

authorization][-c compartment ][

-g [gid|groupname]] [-G

[gid|groupname]]

[-p privileges ][-u

[uid|username]] [-U [uid|username]] [-v

[-v]] command [args ]

DESCRIPTION

privrun allows a user to run legacy applications with elevated privileges according to the authoriza-

tions associated with that user. The user invokes

privrun, specifying the legacy application as com-

mand line arguments.

privrun consults the /etc/rbac/cmd_priv

database to determine which

authorization is required to run the command with additional privileges. (The authorization is speciﬁed

as an operation and a target object.) If the user has the necessary authorization,

privrun invokes the

speciﬁed command after changing its UID and/or GID as speciﬁed in the

cmd_priv database. privrun

also allows a command to be run with a speciﬁed set of ﬁne-grained privileges, and/or in a speciﬁed com-

partment.

The method to determine whether the user has the necessary authorization is conﬁgurable by the system

administrator. A module is provided to associate a ﬁxed set of authorizations with the user based on the

user’s role. See rbac(5) for more information.

Options

privrun recognizes the following options:

-a authorization

Match only those entries requiring the speciﬁed authorization. authorization is deﬁned as

(operation ,object ) pairs in the cmd_priv database. The speciﬁed authorization must exactly

match the authorization present in the

cmd_priv ﬁle (that is, wildcarding not supported.)

-c compartment

Matches the speciﬁed compartment in the cmd_priv database. The speciﬁed compartment must

exactly match the compartment present in the cmd_priv ﬁle.

-g [gid|groupname]

Match only those entries containing the effective group ID (EGID) corresponding to the speciﬁed

EGID or the EGID associated with the group name.

-G [gid|groupname]

Match only those entries containing the real group ID (RGID) corresponding to the speciﬁed RGID

or the RGID associated with the group name

-h Prints privrun usage or help.

-p privileges

Matches the speciﬁed privileges to the privileges in the cmd_priv database. When specifying mul-

tiple privileges, separate each privilege with a comma. Any privileges speciﬁed with -p option,

must have a match in the cmd_priv database.

-t Check to see if the user has the authorization to execute the command and inform the user of the

results. The command will not be invoked.

-u [uid|username]

Match only those entries containing the effective user ID (EUID) corresponding to the speciﬁed

EUID or the EUID associated with the user name.

-U [uid|username]

Match only those entries containing the real user ID (RUID) corresponding to the speciﬁed RUID or

the RUID associated with the user name.

-v [-v]

Invoke privrun in verbose mode. The verbose level will be increased if two -v options are

speciﬁed. An increased verbose level will print more information.

-x If the authorization check fails, the program will still be executed with original caller’s privileges

only.

HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1

Summary of content (4 pages)

PAGE 1
privrun(1M) privrun(1M) NAME privrun - invoke another application with privileges after performing appropriate authorization checks and optionally reauthenticating the user SYNOPSIS [-htx] [-a authorization] [-c compartment ] [-g [gid|groupname] ] [gid|groupname] ] [-p privileges ] [-u [uid|username] ] [-U [uid|username] ] [-v [-v] ] command [args ] privrun [-G DESCRIPTION privrun allows a user to run legacy applications with elevated privileges according to the authorizations associated with that user
PAGE 2
privrun(1M) privrun(1M) Operands privrun recognizes the following operands: command [args ] The HP-UX command to run. command must be fully qualified. If it is not, then privrun will use the current working directory and the PATH environment variable to determine the desired command. args specifies any argument that the command recognizes. The cmd_priv Database The /etc/rbac/cmd_priv file contains information on which authorizations are required to execute each command binary, or edit each file.
PAGE 3
privrun(1M) pam-service privrun(1M) Reauthentication service. If specified, the user will be reauthenticated. The privrun command will identify itself to PAM as the service indicated in this field. This allows the security officer to require an additional set of restrictions for particular commands. See pam.conf (4) for a list of PAM services. The keyword DFLT must be used to indicate that no reauthorization is required. flags This field is used by both privrun and privedit.
PAGE 4
privrun(1M) privrun(1M) /etc/rbac/auths Database containing definitions of all valid authorizations. /etc/rbac/user_role Database specifying the roles for each specified user. /etc/rbac/role_auth Database defining the authorizations for each role. /etc/rbac/cmd_priv Database defining the authorization information needed to execute commands and and edit files under access control. SEE ALSO authadm(1M), cmdprivadm(1M), privileges(5), rbac(5).