Open System Services System Calls Reference Manual (G06.29+, H06.08+, J06.03+)

System Functions (s and S) setfilepriv(2)
NAME
setfilepriv - Sets one or more file privileges for an executable file
LIBRARY
H-series and J-series native Guardian Procesess: implicit libraries
H-series and J-series OSS processes: implicit libraries
SYNOPSIS
#include <sys/privileges.h>
int setfilepriv(
const char *path,
const unsigned char *fileprivs
);
PARAMETERS
path Points to the OSS pathname of the executable file.
fileprivs Points to the bit pattern that determines the privileges for the file.
DESCRIPTION
The setfilepriv() function sets the file privileges of the OSS regular file or Guardian disk file
specified in the path parameter according to the bit pattern specified by the fileprivs parameter.
File privileges are not supported for file types other than OSS regular files or Guardian disk files.
File privileges are ignored for files that are not executable files, DLLs, or user libraries. For
example, file privileges are ignored for shell scripts and TACL scirpts.
The fileprivs parameter is constructed by logically ORing one or more of these symbols, which
are defined in the sys/privileges.h header file:
PRIVNONE Resets the file privileges so that file has no special privileges.
PRIVSETID If the super ID (255,255 in the Guardian environment, 65535 in the OSS environ-
ment) runs an executable file that has this file privilege, the resultant process is
permitted to perform a privileged switch (such as by using the setuid() function)
to another user ID, group ID, or both to access files in a restricted-access fileset.
PRIVSOARFOPEN
If a locally-authenticated member of the Safeguard
SECURITY_OSS_ADMINISTRATOR (SOA) group runs an executable file that
has this file privilege, the resultant process is permitted to perform additional
system calls needed to back up and restore files in a restricted-access fileset.
These system calls include open(), open64(), creat(), creat64(), link( ),
remove_oss( ), unlink(), rmdir(), and utime( ),
NOTES
This function is supported on systems running J06.11 or later J-series RVUs or H06.22 or later
H-series RVUs only
Only Members of Safeguard SECURITY-PRV-ADMINISTRATOR (SEC-PRIV-ADMIN or
SPA) group are permitted to explicitly set or reset file privileges. Therefore only members can set
the PRIVSOARFOPEN file privilege on the Backup and Restore product to enable members of
the Safeguard SECURITY_OSS_ADMINISTRATOR (SOA) group to back up and to restore files
that are in restricted-access filesets. See the initfilepriv command.
File privileges are also removed from a file if the file is modified. Any changes to the file
privileges on a file is audited. File privileges are inherited by child processes created using the
fork() function.
527186-023 Hewlett-Packard Company 7−57