Runs a least-privilege (LP) resource.
runlpcmd -N resource_name │ RunCmdName [-h] [-TV] ["flags_and_parms"]
runlpcmd -a -N resource_name │ RunCmdName [-h] [-TV] ["flags_and_parms"]
runlpcmd -n host1 [,host2,…] -N resource_name │ RunCmdName [-h] [-TV] ["flags_and_parms"]
The runlpcmd command runs an LP resource, which is a root command or script to which users are granted access based on permissions in the LP access control lists (ACLs). You can use the runlpcmd command to call the LP command corresponding to a particular RunCmdName value with access permissions that match the permissions of the calling user. When runlpcmd is called with the -N flag, the LP command that is specified by the resource_name parameter is run. Specify all parameters and flag needed for command invocation using the flags_and_parms parameter. If this parameter is not specified, an empty string is passed to the LP command. This is the default.
If the CheckSum attribute value is 0, runlpcmd returns an error if the ControlFlags value is set to check for CheckSum; otherwise, no errors are returned. If the ControlFlag attribute of the LP command was set to validate the CheckSum before the LP command was run, runlpcmd performs such a check. The command is run only if the calculated CheckSum matches the value of the corresponding CheckSum attribute. If the two do not match, the command is rejected. If, however, the ControlFlags attribute is set to the default value, CheckSum validation is not performed.
You can specify the RunCmdName parameter along with with the -N resource_name flag and parameter combination. However, one restriction applies when you use the RunCmdName parameter. If more than one resource matches the RunCmdName value and the permissions of the calling user, runlpcmd returns an error. If one match exists for the RunCmdName value and the the permissions of the calling user, runlpcmd RunCmdName returns successfully. In order to circumvent this restriction, runlpcmd also lets users run LP commands by specifying their unique names, using the -N resource_name flag and parameter combination.
Before calling the LP command, runlpcmd checks to see if a FilterScript value exists. If so, it passes the FilterArg value and the flags_and_parms parameter string specified on the command line to FilterScript. If FilterScript returns a 0, runlpcmd calls the LP command. If FilterScript execution resulted in a non-zero value, runlpcmd returns an error. If FilterScript was empty, runlpcmd performs some checks, as specified in ControlFlags, and then calls the LP command directly.
The output of this command may include "RC=return_code" as the last line.
This command runs on any node. If you want this command to run on all of the nodes in a domain, use the -a flag. If you want this command to run on a subset of nodes in a domain, use the -n flag. Otherwise, this command runs on the local node.
The runlpcmd command runs once for the first valid scope that the LP resource manager finds.
As an alternative, the Resource ACL can direct the use of the Resource Shared ACL if this permission exists in the Resource Shared ACL.
If this environment variable is not set, local scope is used.
This command is part of the Reliable Scalable Cluster Technology (RSCT) fileset for AIX®.
When the -h flag is specified, this command's usage statement is written to standard output. When the -V flag is specified, this command's verbose messages are written to standard output.
All trace messages are written to standard error.
runlpcmd LP1 "-a -p User Group"