HP UX 11i Role-based Access Control (RBAC) Software Configuring HP-UX Rbac with Compartments

Page 43

fine-grained privilege and without UID=0 if the user has the (hpux.adm.mount, *) authorization.

As described in “Using the privrun Command to Run Applications with Privileges”, the privrun -pcommand option matches only the entries in the /etc/rbac/cmd_priv database file that have the privileges specified by the -poption. Be aware when you specify a privilege using the privrun -poption that privrun will match all entries that contain the specified privilege—including groups of privileges and compound privileges that include the -pspecified privilege. The privrun command will execute according to the first match in /etc/rbac/cmd_priv. For example, the following is an example privrun -pcommand and a list of entries the command will match in /etc/rbac/cmd_priv:

The command:

# privrun -p MOUNT /etc/mount

matches the following /etc/rbac/cmd_priv entries:

#---------------------------------------------------------------------------------------------------------------

 

 

 

 

 

 

# Command

: Args

:Authorizations

:U/GID :Cmpt

:Privs

:Auth

:Flags

#----------------

:--------

:-------------------

:------

:------

:---------------------------------------

:-----

:-----

/etc/mount

:dflt

:(hpux.adm.mount,*)

:///

:dflt

:PRIV_CHOWN, MOUNT

:dflt

:

/etc/mount

:dflt

:(hpux.*,nfs)

:///

:dflt

:MOUNT, PRIV_RTPRIO, PRIV_MLOCK

:dflt

:

/etc/mount

:dflt

:(hpux.adm.*,*)

:///

:dflt

:BASICROOT

:dflt

:

NOTE: The privrun -p MOUNT /etc/mount command matches the BASICROOT privilege because the MOUNT simple privilege is part of the predefined BASICROOT compound privilege. Refer to the privileges(5) manpage for more information about simple and compound privileges.

IMPORTANT: The sequence of the entries in /etc/rbac/cmd_priv is important because privrun will execute according to the first explicit match it finds. In the preceding example, while all three entries are considered matches to the privrun command, privrun would execute the first entry. Keep the sequence of the entries in mind when configuring commands and authorizations. The cmdprivadm tool adds entries to the bottom of the /etc/rbac/cmd_priv file.

NOTE: Use only the cmdprivadm command to configure fine-grained privileges for commands—do not edit the /etc/rbac/cmd_priv database file without using cmdprivadm.

To modify an existing entry in the /etc/rbac/cmd_priv file, you must first delete the entry and then add the updated version back in. When you use cmdprivadm to delete entries, arguments act as filters. For example, specifying the cmdprivadm delete op=foo command removes all entries in which the operation is foo. As a result of this, when you use cmdprivadm to delete entries, be careful to ensure that you specify sufficient arguments to uniquely identify the entries to be removed.

Configuring HP-UX RBAC with Compartments

NOTE: HP-UX RBAC version B.11.23.01 does not support the Compartments component of the HP-UX 11i Security Containment feature.

HP-UX RBAC can also use the Compartments component of the HP-UX 11i Security Containment feature to configure applications to run in a particular compartment. With the Compartments component you can logically partition a system into compartments so that a process cannot communicate or access resources outside of its compartment (unless a compartment rule is set up to allow this).

Configuring HP-UX RBAC 43

Page 42 Page 44
Image 43
Page 42 Page 44
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Publishing History About This DocumentIntended Audience New and Changed Information in This EditionHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Account Policy Management AuthorizationHP-UX 11i Security Containment Introduction Conceptual OverviewAuditing Features and BenefitsDefined Terms IsolationFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements # swlist -a state -l fileset SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swverify SecurityExt# swverify Rbac Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Standard Mode Security Extensions# swlist -a state -l fileset TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swverify TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ArchitectureHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Examples of Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles OverviewHierarchical Roles Considerations Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Example 3-2 Example of the authadm Command UsageConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Fine-Grained Privileges Components CommandsFine-Grained Privileges Commands Fine-Grained PrivilegesAvailable Privileges Available PrivilegesManpages Fine-Grained Privileges ManpagesOr launch policy Configuring Applications with Fine-Grained PrivilegesCompound Privileges Privilege Model# setfilexsec options filename Privilege Escalation Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Security Implications of Fine-Grained Privileges# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment Configuration# cmpttune -e Modifying Compartment ConfigurationActivating Compartments # setrules -pChanging Compartment Names Compartment Configuration FilesCompartment Components Changing Compartment RulesCompartment Manpages Compartment CommandsCompartment Configuration Files Compartment CommandsCompartment Definition Compartment Rules and SyntaxFile System Rules Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions System Security Attributes Configuring Systemwide AttributesConfiguration Files Security Attributes and the User DatabaseAttributes CommandsManpages Auditing Components Configuring Attributes in the User DatabaseTroubleshooting the User Database AuditingEnabling Auditing Audit CommandsAuditing Your System Planning Your Auditing Implementation#audsys -n -c primaryauditfile -s # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac Monitoring Audit Files#audsys -f Guidelines for Administering Your Auditing SystemAuditing Users Performance Considerations# /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audevent command optionsAuditing Events Streamlining Audit Log DataSelf-auditing processes Audit Log FilesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb
Top Page Image Contents