wlipolicy.1 (2011 03)

wlipolicy(1)
Optional WLI Product Required
wlipolicy(1)
NAME
wlipolicy - manage WLI file access policies
SYNOPSIS
wlipolicy -f {-a|-d} -k
privkey [-p src:val][-s] targetfile
wlipolicy -i {-a|-d} -k
privkey [-p src:val] -e execfile targetfile
wlipolicy -m -k old_owner_privkey [
-p src:val]
-c new_owner_pubkey targetfile
wlipolicy -n -k new_owner_privkey [
-p src:
val] -c old_owner_pubkey targetfile
wlipolicy -v -e execfile targetfile
wlipolicy -l targetfile
wlipolicy -h
DESCRIPTION
wlipolicy is used to create, modify, verify, and delete WLI file access policies. There are two policy
types:
•
file lock access control (FLAC) - When a FLAC policy is assigned to targetfile,it
cannot be modified, deleted or moved to a different location.
•
identity based access control (IBAC) - When an IBAC policy is assigned to a
targetfile, it can only be opened through a set of authorized executables that are identified
through their WLI signatures. for more information on signing executables, see wlisign(1).
A file cannot have both policy types. They are mutually exclusive. A file can have multiple IBAC policies
or one FLAC policy. For more information on policy types and signatures on authorized executables, see
wli(5).
All policy information is stored as metadata in accordance with the storage type specified with
wlisys (1M). Included in the policy metadata is a signature generated by privkey . Only privkey can be
used to modify or delete information within the policy. A file access policy for any regular file or directory
can be generated by a user with write permission to the file.
A file access policy can be modified or deleted with
wlipolicy only by using the same key that created
the policy. The key used to generate the policy effectively owns the policy. Key ownership for a file access
policy can be transferred to another key through a two step process:
• The current owner key is used to authorize the new public key as owner.
• The new owner private key is used to generate a signature that replaces the previous owner sig-
nature.
The
wlipolicy command is installed with the optional HP-UX Whitelisting (WLI) product.
Options
-a Adds a file access policy to targetfile. You can add a single FLAC policy or several
IBAC policies.
-c pubkey The new owning public key when used with the -m option. When used with the -n
option, the current owning public key.
-d Deletes a policy, either of type FLAC or IBAC, from targetfile. If the policy type is
IBAC, only the policy pertaining to execfile is deleted.
-e execfile Identifies execfile as the signed executable binary in conjunction with the -v or -i
options.
-f A FLAC policy is to be added or deleted.
-h Displays wlipolicy command syntax
-i An IBAC policy is to be added or deleted.
-k privkey File containing an RSA private key. This option is required with the -a, -d, -m,
and -n options.
-l targetfile Lists details of the file access policies for targetfile.
HP-UX 11iv3: Sep 2010 Web Release − 1 − Hewlett-Packard Company 1