Administrator's Guide

|[re-auth=pam_service_name]
|[flags=comma_separated_flags_list]
cmdprivadm delete cmd=full_path_name_of_a_command | full_path_name_of_a_file
|[op=operation]|[object=object]
|[ruid=ruid]|[euid=euid]
|[rgid=rgid]|[egid=egid]
|[compartment=compartment_label]
|[privs=comma_separated_privilege_list]
|[re-auth=pam_service_name]
|[flags=comma_separated_flags_list]
The following is a list and brief description of the two main cmdprivadm command
arguments:
add Adds command (or file) authorization information to the
/etc/rbac/cmd_priv database.
delete Deletes command (or file) authorization information in the
/etc/rbac/cmd_priv database.
The following example demonstrates the most common cmdprivadm arguments:
# cmdprivadm add cmd=/opt/customcmd \
op=companyname.customcommand ruid=0 euid=0 flags=edit \
/opt/customcmd::(companyname.customcommand,*):0/0/-1/-1::::edit
cmdprivadm added the entry to /etc/rbac/cmd_priv
As shown in the previous example, the cmd_priv file database file contains a field for
flag values. Be sure to consider the value of the cmdprivadm flags when configuring
command or file authorization and privilege information.
The privrun command recognizes one defined flag, KEEPENV. If the KEEPENV flag
is set in the cmd_priv file for a particular command, none of the environment variables
will be scrubbed when privrun wraps that particular command.
For privedit, you can specify flag values to indicate whether or not privedit can
edit a file. Additional flag values can be specified to indicate whether privrun can
execute a command. The following are the supported flag values:
flag=empty or any other token Indicates the file can only be executed and cannot
be edited.
flag=edit Indicates the file can be both edited and executed.
This flag is mainly intended for scripts.
flag=noexec Indicates the file cannot be executed and can only
be edited with privedit.
8.5 Configuring HP-UX RBAC 159