HP-UX Reference (11i v3 07/02) - 1M System Administration Commands A-M (vol 3)

c
cmdprivadm(1M) cmdprivadm(1M)
NAME
cmdprivadm - noninteractive editing of a command’s authorization and privilege information in the privrun
database
SYNOPSIS
cmdprivadm add option=value [option
=value]...
cmdprivadm delete option=value [option
=value]...
DESCRIPTION
cmdprivadm is a noninteractive command that allows user with appropriate permission to add or delete
a command and its privileges in the Role-Base Access Control (RBAC) database,
/etc/rbac/cmd_priv
. See privrun(1M) for more details on this file.
When adding a line to the database,
cmdprivadm
sets fields that are not specified a default value. When
deleting a line, the lines matching all the given option
=value pairs will be deleted. That is, if all fields
specified match, the entry will be deleted.
cmdprivadm add option=value [option
=value]...
Appends a line as specified in option
=value pairs in the /etc/rbac/cmd_priv
file.
cmdprivadm delete option=value [option=value]...
Deletes a line as specified in option=value pairs from /etc/rbac/cmd_priv
file.
HP recommends that only the
authadm, cmdprivadm, and roleadm commands be used to edit and
view the RBAC databases; do not edit the RBAC files directly.
See rbac(5) for information on the RBAC databases.
Options
The following options are valid option=value pairs for cmdprivadm .
cmd=command command should include the full path name of the command. There can be one or
more arguments following the command.
file=filename filename should specify the full path name of a file name.
op=operation Specifies the operation.
object=object Specifies the object.
ruid=ruid Specifies the real user ID (ruid).
euid=euid Specifies the effective user ID (euid).
rgid=rgid Specifies the real group ID (rgid).
egid=egid Specifies the effective group ID (egid).
compartment= compartment_label
Specifies the compartment.
privs=comma_separated_privilege_list
Specifies the privileges.
re-auth=pam_service
Specifies the PAM service name to reauthenticate under. See pam.conf(4) for a list of
PAM services.
flags=comma_separated_flags_list
Specifies the flags.
Note: You must enclose values that contain the space character, or any characters that may be interpreted
by the shell, with single quotes. For example, if the cmd has one or more arguments, enclose them with
single quotes:
cmd=’mount -a’
Authorizations:
In order to invoke cmdprivadm, the user must either be root, (running with effective UID of 0), or have
the appropriate authorizations. The following is a list of the required authorizations for running
120 Hewlett-Packard Company − 1 − HP-UX 11i Version 3: February 2007