HP-UX Reference (11i v3 07/02) - 1M System Administration Commands N-Z (vol 4)

ManualsBrandsHP ManualsSoftwareHP-UX Reference Manuals

161

162

163

164

165

166

167

168

169

170

privedit(1M) privedit(1M)

International Code Set Support

Single-byte character code set is supported.

RETURN VALUE

Success If

privedit permitted the user to edit the ﬁle, then the return value from privedit is the

return value of the editor used to edit the ﬁle.

Failure

privedit returns a value of 1 and an appropiate error message is printed to standard error.

EXAMPLES

Example 1

In the following example, the caller invokes

privedit

to edit /etc/fstab .

# privedit /etc/fstab

The /etc/rbac/cmd_priv

database is examined for an entry corresponding to the ﬁle

/etc/fstab .

If this entry is found, then the necessary authorization is retrieved from that entry.

privedit then

determines whether the user has the necessary authorization and whether the ﬁle is allowed to be edited as

determined by the value in the ﬂag ﬁeld.

privedit then invokes the editor to edit a copy of

/etc/fstab ; as the original ﬁle is never edited directly.

The EDITOR environment variable determines which editor privedit invokes. If a user does not set the

EDITOR environment variable, privedit uses the default editor, vi. After the user exits the editor, the

edited ﬁle replaces the original ﬁle. The editor is always invoked as the regular user so that there are no

additional privileges given to the user while the ﬁle is being edited.

Example 2

In the next example, the caller wants to edit the ﬁle /etc/default/security

with a speciﬁc authori-

zation of

(hpux.sec.edit,secfile)

# privedit -a "(hpux.sec.edit,secfile)" /etc/default/security

If a /etc/rbac/cmd_priv

entry exists for the ﬁle /etc/default/security with the associated

authorization

(hpux.sec.edit,secfile)

and editing is allowed per the ﬂag ﬁeld, then the usual

authorization/edit process takes place. If this entry does not exist, (even if an entry for

/etc/default/security

appears with different associated authorization (operation,object)), then

privedit fails and prints an error message.

FILES

/etc/rbac/roles

Database containing valid deﬁnitions of all roles.

/etc/rbac/auths

Database containing deﬁnitions of all valid authorizations.

/etc/rbac/user_role

Database specifying the roles for each speciﬁed user.

/etc/rbac/role_auth

Database deﬁning the authorizations for each role.

/etc/rbac/cmd_priv

Database that contains the authorization to execute or edit speciﬁed commands or

ﬁles, and the privileges to alter UID and GID for command execution.