PRIVS(5)

NAME
privs - privilege file

DESCRIPTION
The file expresses the rules whereby priv(1) grants privilege. It consists of a list of statements, each terminated by a semicolon. One or more comments, each extending from to newline, may precede each statement.

  Rights
Rights are defined thus:

    DEFINE rights-list;

Each right in the comma-separated rights-list has a name, and optionally a parenthesized parameter type. The types are

LAB Label, ordered by lattice value.

RE  Regular expression ordered by language inclusion. Regular expressions are in the form of regexp(3), with enclosing and understood.

PRIV
    Set of privileges in atopriv form, ordered by inclusion; see labtoa(3).

Examples:

    DEFINE ceiling(LAB), filename(RE), privinstall;

Rights are identifiers used solely by priv; they have no other manifestation in the system. In the example, the right involves label comparisons, but has no necessary connection to process ceilings. The name could be changed globally to, say, without affecting the interpretation of

  Authorization
Authorization is expressed by a tree. Nodes of the authorization tree are named, like files in the file system, by full pathnames starting from the root, Associated with each node are statements to grant rights, and statements to admit access to the node. Rights are monotone in the tree: the rights at a node must be a subset of the rights at its parent. Access to a node implies access to its children.

Right-granting statements have the form

    RIGHTS nodename rights-list;

A rights-list is as in a rights definition, but with explicit values for parameters. White space or one of the metacharacters may be included in a value by placing double quotes around it. Examples:

        RIGHTS	/admin	priv(upxnl), ceiling(ffff...);
        RIGHTS	/admin/security	priv(p), ceiling("ffff ...");
        RIGHTS	/admin/operations	priv(xn)

Access statements have the form

    ACCESS nodename pred-list;

Access to the named node is granted when the comma-separated pred-list is nonempty and all the predicates in the list are satisfied. A node may have more than one ACCESS statement. Legal predicates are

ID(lognames)
    A regular expression for login names that have access to this node.

PW(name ...)
    The password associated with one of the names in pwfile(5) must be presented.

SRC(source)
    A regular expression for the stream identifier of the standard input.

  Rules
Rules give patterns for requests and show the prerequisite rights for and the actions to carry out each request:

    REQUEST(arguments) NEEDS rights DOES actions ;

The request part shows arguments supplied to priv(1); normally the arguments spell out the prefix of a UNIX command. The NEEDS part tells what rights are needed to perform the request. The rights are as in a rights statement, with substituted parameters; see `Parameter values'.

If the process has access to a node that grants the needed rights (with the parameter in each grant dominating the parameter of the corresponding need), then the actions for the request are performed. Otherwise the request is denied. Legal actions are

PRIV(gunxlp)
    Set one or more process licenses, abbreviated as in labtoa(3).

EXEC(args)
    Execute a program given by the args. Members of the args list are separated by white space and may specify substitutions; see `Parameter values'. EXEC does not do a sh(1)-like $PATH search.

DAEMON(args)
    Same as EXEC, but do not wait for the command to complete.

CEILING(label)
    Set the process ceiling.

PRIVEDIT(node file)
    Read editing commands from the named file. Only the subtree at node is editable; nodes closer to the root cannot be touched.

ANYSRC
    Skip the normal check for a trusted source; see priv(1).

The order in which nodes of the authorization tree are visited in evaluating a NEEDS clause is undefined, however at each node the predicates of the request are evaluated in order. The actions of a granted request are also performed in order, with effects such as privilege settings persisting until the end of the priv command or until overridden by a later action.

  Parameter values
Parameter values appear in members of NEEDS and DOES lists. A value may be surrounded by double quotes, in which case the value may contain white space or one of the metacharacters A value may contain substitution marks, $0, $1, ... Each such mark is replaced from the priv invocation, $0 standing for the match to the first argument of the REQUEST and so on. If a star is appended to the mark (e.g. $0*, $1*), the argument and all following ones are copied into the parameter list. Nothing can follow a star mark in a parameter.

  Editing
Statements of the above forms may be used with action PRIVEDIT to augment a privs file. Further types of statements exist for editing only:

RMDEFINE rights-list ;
    Remove all occurrences of the listed rights from the file.

RMACCESS nodename pred-list ;
RMRIGHTS nodename rights-list ;
    Remove the given access list or the given rights from the named node. If the list is empty, remove all access lists or rights.

RMREQUEST(arguments);
    Remove the REQUEST with identical arguments.

RMNODE path-list;
    Remove the listed subtrees.

DEFINE, RMDEFINE, REQUEST, and RMREQUEST are understood to modify the root.

EXAMPLES
    REQUEST(session -l)
    	NEEDS ceiling($2)
    	DOES PRIV(nx) EXEC(/bin/session -l $2);
    REQUEST(/etc/downgrade -l)
    	NEEDS downgrade($2)
    	DOES PRIV(nx) EXEC($*);

FILES

SEE ALSO
priv(1), privserv(8)

BUGS
There is no way to quote a newline or an initial double quote in parameters.
If an ACCESS or RMACCESS statement contains duplicate predicates, RMACCESS may remove an unintended list.