HP UX 11i Role-based Access Control (RBAC) Software manual Is mainly intended for scripts

Use the cmdprivadm command to edit a command's authorization and privilege information. The cmdprivadm command works in a similar fashion to roleadm and authadm, but cmdprivadm has fewer sub-operations: only addition and removal.

The following shows the cmdprivadm command syntax:

cmdprivadm add <cmd=full path name of a command full path name of a file> [op=operation][object=object] [ruid=ruid][euid=euid] [rgid=rgid][egid=egid] [compartment=compartment label]

[privs=comma separated privilege list] [re-auth=pam_service name] [flags=comma separated flags list]

cmdprivadm delete <cmd=full path name of a command full path name of a file>

[op=operation][object=object]

[ruid=ruid][euid=euid]

[rgid=rgid][egid=egid] [compartment=compartment label] [privs=comma separated privilege list] [re-auth=pam_service name] [flags=comma separated flags list]

The following is a list and brief description of the two main cmdprivadm command arguments:

add Adds command (or file) authorization information to the /etc/rbac/cmd_priv database.

delete Deletes command (or file) authorization information in the /etc/rbac/cmd_priv database.

The following example demonstrates the most common cmdprivadm arguments:

#cmdprivadm add cmd=/opt/customcmd op=companyname.customcommand ruid=0 euid=0 flags=edit /opt/customcmd::(companyname.customcommand,*):0/0/-1/-1::::edit

cmdprivadm added the entry to /etc/rbac/cmd_priv

As shown in the previous example, the cmd_priv file database file contains a field for flag values. Be sure to consider the value of the cmdprivadm flags when configuring command or file authorization and privilege information.

The privrun command recognizes one defined flag, KEEPENV. If the KEEPENV flag is set in the cmd_priv file for a particular command, none of the environment variables will be scrubbed when privrun wraps that particular command.

For privedit, you can specify flag values to indicate whether or not privedit can edit a file. Additional flag values can be specified to indicate whether privrun can execute a command. The following are the supported flag values:

flag=empty or any other token	Indicates the file can only be executed and cannot be edited.
flag=edit	Indicates the file can be both edited and executed. This flag
	is mainly intended for scripts.
flag=noexec	Indicates the file cannot be executed and can only be edited
	with privedit.

Configuring HP-UX RBAC 39