HP-UX Reference (11i v2 07/12) - 5 Miscellaneous (vol 9)

p
privileges(5) privileges(5)
NAME
privileges - description of HP-UX privileges
DESCRIPTION
The UNIX operating system has traditionally used an "all or nothing" privilege model, where root users
(those with effective UID 0
, such as the user named root) have virtually unlimited power, and other
users have few or no special privileges.
System administrators often need to delegate limited powers to other users. HP-UX provides several ways
to do this. Because these mechanisms permit users other than root users to perform certain privileged
operations, HP-UX documentation often uses terms such as "privileged user" or "user who has appropriate
privileges" instead of "root user" when describing who is permitted to perform an operation.
In the absence of a more specific description of the privileges necessary to perform an operation (typically
available in the man page for that operation), you can generally assume that root users are suitably
privileged.
Legacy Delegation Methods
HP-UX has used several methods of delegating limited powers, including restricted
sam, the privilege
groups described in privgrp(5), the shutdown.allow
file described in shutdown(1M), and the
cron.allow file described in crontab(1).
Fine-Grained Privileges
Fine-grained privileges are a part of the Security Containment enhancement. If the Security Containment
enhancement is not installed, none of the information presented below is applicable to your system.
The HP-UX fine-grained privilege model splits the powers of root users into a set of privileges. Each
privilege grants a process that possesses that privilege the right to a certain set of restricted services pro-
vided by the kernel. Privileges can be managed internally by a process with "privilege bracketing".
Privilege bracketing is the practice of enabling, or "raising", a privilege only while the privilege is needed,
then disabling, or "lowering", the privilege. The privileges that a process has raised determine which sensi-
tive system call services the process can invoke.
Legacy Privileges
Legacy privileges are those privileges originally defined in privgrp(5). All of the privileges from that set
except PRIV_SETRUGID have been incorporated into fine-grained privileges:
PRIV_CHOWN ,
PRIV_FSSTHREAD, PRIV_LOCKRDONLY
, PRIV_MLOCK , PRIV_MPCTL , PRIV_PSET,
PRIV_RTPRIO , PRIV_RTSCHED , PRIV_SERIALIZE
, PRIV_SPUCTL .
Basic Privileges
Basic privileges are granted by default to all processes. The basic privileges are the set of the following:
PRIV_EXEC, PRIV_FORK, PRIV_LINKANY , PRIV_SESSION .
Root Replacement Privileges
Root replacement privileges are the privileges that provide the powers associated with a process that has an
effective user ID of zero. This set of privileges includes the legacy privileges and a number of new
privileges, which consists of the following: PRIV_ACCOUNTING
, PRIV_AUDCONTROL, PRIV_CHOWN,
PRIV_CHROOT , PRIV_CHSUBJIDENT, PRIV_DACREAD , PRIV_DACWRITE
, PRIV_DEVOPS ,
PRIV_DLKM, PRIV_FSINTEGRITY, PRIV_FSS, PRIV_FSSTHREAD
, PRIV_LIMIT ,
PRIV_LOCKRDONLY, PRIV_MKNOD, PRIV_MLOCK , PRIV_MOUNT, PRIV_MPCTL ,
PRIV_NETADMIN, PRIV_NETPRIVPORT, PRIV_NETPROMISCUOUS
, PRIV_NETRAWACCESS,
PRIV_OBJSUID , PRIV_OWNER , PRIV_PSET , PRIV_REBOOT , PRIV_RTPRIO , PRIV_RTSCHED ,
PRIV_RTPSET , PRIV_SELFAUDIT, PRIV_SERIALIZE, PRIV_SPUCTL ,
PRIV_SYSATTR ,
PRIV_SYSNFS . These privileges are granted by default to any process with an effective user ID of zero.
Policy Override Privileges
Policy override privileges override compartment rules. There are four policy override privileges:
PRIV_CHANGECMPT, PRIV_CMPTREAD, PRIV_CMPTWRITE
, PRIV_COMMALLOWED. These
privileges are not granted by default to processes with an effective user ID of zero. Although these
privileges are present whenever Security Containment is installed, they only apply to an extended feature
of that enhancement (see compartments(5) and cmpt_tune(1M) to determine if this extended feature is
enabled). These privileges comprise part of the set of privileges in the compound privilege
POLICY.
HP-UX 11i Version 2: December 2007 Update − 1 − Hewlett-Packard Company 317