filepriv(ADM)
filepriv --
set, delete, or display privilege information associated with a file
Synopsis
filepriv
[-f priv[, . . .]]
[-i priv[, . . .]] file . . .
filepriv -d file . . .
Description
filepriv is used to set, delete, or display
the privilege information associated
with a file.
Command options
-d-
used to delete the privileges associated with the named file;
also used to delete non-existent files from
the Privilege Data File (PDF).
-f priv,priv, . . .-
used to specify the fixed privileges associated with the
named file.
-i priv,priv, . . .-
used to specify the inheritable privileges associated with the
named file.
The following describes the privileges that may be specified:
priv [ +|-priv_name . . . ] set_name [ . . . ]
For each set_name,
priv sets or displays the privileges
contained in that privilege set.
set_name may be either max for the
maximum privilege set or work for the working set.
priv_name is the name of a privilege.
If priv_names are
supplied, priv scans the list and turns off thoses
privileges
that are preceded by a minus sign and turns on those that are
preceded
by a plus sign in each of the sets listed.
If no priv_names are supplied, the priv command
prints
the current list of privileges for each of the requested sets.
The values for priv_name are:
allprivs-
Represents all possible privileges.
audit-
Required to manipulate the security audit mechanisms.
auditwr-
Required to write miscellaneous audit records to the audit trail.
compat-
Overrides specific restrictions that are imposed solely for the
confinement of covert channels.
core-
Required to dump a core image of a process that is either privileged,
setuid, or setgid.
This privilege is not required to dump the core image of a process that
does not meet the above conditions.
dacread-
Overrides Discretionary Access Control (DAC) restrictions but only for
operations that do not alter objects (that is, read and execute
permissions).
See ``Access permissions''.
dacwrite-
Overrides Discretionary Access Control restrictions but only for
operations that alter objects (that is, write permission).
See ``Access Permissions''.
dev-
Required to set or get device security attributes to change the device
level when it is in private state, and to access a device when it is in
private state.
This privilege is also used for special ioctl
for window management and to download trusted software to a terminal driver.
driver-
Provides compatibility with device drivers developed by third party vendors.
It is used when a sensitive operation needs to be limited to
a privileged process.
filesys-
Required for privileged operations on a filesystem that have relatively
low sensitivity, including the creation of links to directories, setting
the effective root directory, and making special files.
fsysrange-
Override filesystem range restrictions.
loadmod-
Required to perform selective operations associated with loadable modules.
macread-
Overrides Mandatory Access Control (MAC) restrictions but only for certain
operations that do not alter objects.
See ``Access permissions''.
macwrite-
Overrides Mandatory Access Control restrictions that involve the
alteration of objects or other MAC-related attributes.
See ``Access permissions''.
macupgrade-
Allows processes to upgrade (change the existing level to a new
dominating level) files.
mount-
Mount or unmount a filesystem or set and get the ceiling level of a
filesystem.
multidir-
Required for creation of multilevel directories.
owner-
Required to change the attributes of a file (that is, information kept
in the file's inode)
that is not owned by the effective uid of the calling process.
See ``Access permissions''.
plock-
Required to lock a process in memory.
rtime-
Required by processes that do real-time operations.
setflevel-
Required to change the security level of objects
(for block or character special files that are in the public state only),
subject to some restrictions.
setplevel-
Required to change the security level of a process (including the
process's own level), subject to some restrictions.
setspriv-
Administrative privilege required to set the inheritable and fixed
privileges on files.
This privilege overrides access and ownership restrictions.
setuid-
Required in order to set the real and effective user and group
IDs of a process.
setupriv-
Privilege required for an otherwise unprivileged process to set the
inheritable and fixed privileges on a file.
This privilege does not override
access or ownership restrictions.
sysops-
Required to perform several general system operations that have only
minor security implications.
tshar-
Required to raise the priority of a time sharing process or to set
the user priority limit to a value greater than 0.
Access permissions
Access permissions are associated with the priv_name entries.
Access checking is performed whenever a subject (such as a process)
tries to access an object (such as a file or directory).
Permission to access an object is granted or denied on the basis of
mode bits.
The mode bits are known as Discretionary Access Control (DAC).
Mandatory Access Control (MAC) privileges are defined; however, they may not be supported on the system you are using.
The
standard file access permission bit checks are performed to determine if the
process requesting access to the object has permission to access it
in the manner (read, write, and/or execute/search) requested.
Each access mode requested is checked separately using the following
algorithm:
-
If the effective
user
ID
of the process is equal to the user
ID
of the owner of the
file, and the requested access mode bit is set in the
``owner''
bits of the mode, access is granted;
otherwise access checking continues.
-
If the effective group
ID
(or any of the supplementary
group
IDs
of the process) matches the
owning group of the file
and the requested access mode bit is set in the
``group''
bits of the
mode,
access is granted;
otherwise, access checking continues.
-
If the above checks fail, and the requested access mode bit is set
in the
``other''
bits of the mode, access is granted;
otherwise, access is denied
(EACCES is returned).
-
These checks are performed
on every component of the pathname, including the object itself.
If any of the checks fail,
the privileges of the calling process are examined to determine
if the calling process has the
appropriate privilege for the mode requested
(dacread for read and execute/search access,
dacwrite for write access).
The following example adds owner and audit privileges
and deletes dacread privilege from the working set:
priv +owner +audit -dacread work
Privilege information is stored in the Privilege Data File
(PDF) located in /etc/security/tcb/privs.
filepriv must have the P_SETSPRIV and P_SETUPRIV
privileges when setting or deleting file
privileges, otherwise permission is denied.
The argument priv is defined as a process privilege name
(see
Intro(S)).
The argument allprivs can be used to set or delete
all the process privileges available.
The file argument must be an absolute pathname of an executable
file when setting or deleting file privileges.
There must be at least one file argument specified;
otherwise, filepriv exits with an error.
filepriv calls the realpath routine
to resolve symbolic links.
In this way,
when new privileges are entered into the Privilege
Data File for a symbolic link on a file
that already exists in the PDF,
the privileges are associated correctly.
When setting file privileges,
all fixed and inheritable privileges on the
specified file are removed before those privileges specified
by the -f and -i options are applied.
Also,
filepriv will set only
privileges allowed
by the maximum set of privileges
on the process calling
filepriv(S)
as defined by the Privilege Data File.
The filepriv command exits with an error if the
-f and -i options are specified and the same
privilege exists in both.
When deleting privilege information from a file,
the -d option is used.
However,
the -d option is also used to remove a non-existent
file from the privilege database.
If the file exists,
then the -d option deletes privileges.
If the file does not exist
because it is a spurious file or has been removed from the system
without the knowledge of the privilege administrator,
then the -d option removes this file from the privilege
database.
When no options are specified,
filepriv
displays the privileges associated with the named file(s).
Defaults
The file /etc/default/privcmds
contains the parameter GEN_CKSUM.
If the value of GEN_CKSUM is ``No'', filepriv
will not generate a check sum value for the Privilege Data File (PDF)
located in /etc/security/tcb/privs;
this results in faster
performance compared to generating the check sum value each time the
command is run.
If the value of this parameter is anything other than ``No''
(including NULL, the default), filepriv
generates a check sum each time it is run.
Examples
The following is an example of the output when filepriv
is executed with one file:
fixed priv,priv, . . .
inher priv,priv, . . .
If no fixed privileges exist on the file, the fixed
privilege line is not displayed.
If no inheritable privileges exist on the file, the inher
privilege line is not displayed.
The space between the privilege type and privileges is a
single tab (\t) character.
If more than one file is specified, then the file name
followed by a colon (``:'') and space character
is printed before the privileges as follows:
file1: fixed priv,priv, . . .
file1: inher priv,priv, . . .
file2: fixed priv,priv, . . .
file2: inher priv,priv, . . .
file3: fixed priv,priv, . . .
file3: inher priv,priv, . . .
Files
/etc/security/tcb/privs-
Privilege Data File
/etc/default/privcmds-
defaults file
Diagnostics
filepriv exits with a return code of 0 upon successful completion.
If filepriv detects errors,
the following messages may be displayed:
-
undefined process privilege
priv
-
cannot use
priv as both fixed and inheritable privilege
-
cannot access file
file
-
file
is not an executable file
-
permission denied
-
file
is not an absolute pathname
-
incompatible options specified
-
no such file or directory for file
file
-
filepriv system call not in operation
-
Bad entry found in /etc/security/tcb/privs
-
the file
file was not found in the privilege data file
-
cannot create lock for /etc/security/tcb/privs
References
filepriv(S),
initprivs(ADM),
Intro(S)
© 2005 The SCO Group, Inc. All rights reserved.
SCO OpenServer Release 6.0.0 - 02 June 2005