![](/images/new-backgrounds/1330589/33058987x1.webp)
The following is an example cmdprivadm command that configures the /sbin/init.d/hpws_apache command to run only in the apache compartment, which is defined by the /etc/cmpt/apache.rules compartment rule:
#cmdprivadm add cmd='/sbin/init.d/hpws_apache
The preceding cmdprivadm command creates an entry in the /etc/rbac/cmd_priv file, as follows:
|
|
|
|
|
| ||
# Command | : Args | :Authorizations | :U/GID | :Cmpt | :Privs | :Auth | :Flags |
: | |||||||
/sbin/init.d/hpws_apache | :start | :(hpux.network.service.start,apache) | :/// | :apache | :dflt | :dflt | : |
After you create the entry using cmdprivadm and using privrun to wrap the command, authorized users can execute the /sbin/init.d/hpws_apache
NOTE: Use only the cmdprivadm command to configure compartments for
To modify an existing entry in the /etc/rbac/cmd_priv file, you must first delete the entry and then add the updated version back in. When you use cmdprivadm to delete entries, arguments act as filters. For example, specifying the cmdprivadm delete op=foo command removes all entries in which the operation is foo. As a result of this, when you use cmdprivadm to delete entries, be careful to ensure that you specify sufficient arguments to uniquely identify the entries to be removed.
Configuring HP-UX RBAC to Generate Audit Trails
On traditional
The privrun, privedit, roleadm, authadm, and cmdprivadm
•User name
•UID
•Role
•Authorizations (operation, object)
•Time of event
•Result of event (success or failure)
44