HP-UX Reference (11i v3 07/02) - 1M System Administration Commands N-Z (vol 4)

p
privedit(1M) privedit(1M)
Field Description
command | file For privedit, the fully qualified path of a file to edit. This field may contain wild-
cards as defined in fnmatch(3C).
For
privrun, the fully qualified path of the command that is being wrapped to pro-
vide additional privilege.
arguments Ignored. (Used only by privrun.)
(operation,object) The operation the user is required to have on the object specified. Together, the
(operation,object) forms the authorization. operation must be fully qualified and
cannot contain a wild card (
*).
all in object requires that the user has the specified operation on all objects. (Note:
this is satisfied by a specification of
(operation,*) in the /etc/rbac/role_auth
database if RBAC is in use.)
This field may contain the keyword
dflt instead of (operation,object), which indi-
cates that no access check is required and the file can be edited with privilege by any
user.
ruid
/euid/rgid/egid
Ignored. (Used only by privrun.)
compartment Ignored. (Used only by privrun.)
privs Ignored. (Used only by privrun for privileges .)
pam-service Reauthentication service. If specified, the user is required to reauthenticate. The
privedit command identifies itself to PAM as the service indicated in this field.
This allows the security officer to require an additional set of authentication/account
management restrictions for particular files for editing. See pam.conf(4) for a list of
PAM services.
The keyword dflt must be used to indicate that no reauthorization is required.
flags Flag values can be specified to indicate whether or not privedit can edit a file.
Additional flag values can be specified to indicate whether privrun can execute a
command. The specific values allowed are as follows:
flag=empty or any other token
The file is a command that can be executed only. It cannot be edited.
flag=edit The file can be both edited and executed. This is mainly intended for
scripts.
flag=noexec
The file cannot be executed. It can only be edited with privedit.
The Authorization field can contain the keyword
dflt instead of (operation,object), which indicates that
no access check is required and the command is invoked with privilege for any user. The UID and GID
entry in field 4 is ignored by
privedit, but the slash character (/
) separating the IDs must remain. The
pam service name in field 7 may also be
dflt, which indicates reauthentication is not required.
White space between each field (immediately surrounding the field separator :) in this database is optional
and ignored by privedit.
There may be multiple entries with the same file line (but different authorization required). privedit
evaluates each entry in the order specified in the file, continuing on to the next only if the user does not
have the required authorization. The privedit -a command option described above allows users to
identify a specific authorization to match or find when multiple entries for the same file exist in the
cmd_priv database.
EXTERNAL INFLUENCES
Environment Variables
EDITOR specifies the default editor.
LC_MESSAGES determines the language in which messages are displayed.
HP-UX 11i Version 3: February 2007 − 2 − Hewlett-Packard Company 161