auths(C)


auths -- list and/or restrict kernel privileges

Syntax

auths [ -v ] [ -c command ] [ -a authlist | -r authlist ]
auths [ -q ]
auths [ -s ]

Description

auths performs actions associated with system privilege manipulation. With no arguments, auths returns the kernel privileges associated with the current process.

The -a and -r options allow you to alter the kernel privileges in order to run a shell or a single command specified as an argument to the -c option.

auths accepts the following options:


-a authlist
Specifies a list of comma-separated privileges (authlist) that become the absolute set of kernel privileges for the new process. This new set must be a subset of the kernel privileges of the invoking process. To start a process with a null set of kernel privileges, use the empty string "".

-r authlist
Specifies a list of comma-separated privileges (authlist) that are removed from the privileges set of the invoking process when forming the kernel privileges for the new process.
Either of the -a or -r options allow you to alter the kernel privileges in order to run a shell or a single command. See ``Kernel privileges'' for a list of possible kernel privileges.

-c command
Allows you to run a command that has restricted privileges. auths passes the command name to the shell specified in your /etc/passwd entry to be run as a single command. (The shell must support the -c command syntax in the manner of sh(C).)

If this option is absent (and -a or -r is specified), the shell is invoked as a process with adjusted privileges. Exiting the shell will resume execution in the previous shell and the original kernel privileges will be in effect. This option may be used to run a command with restricted privileges, that is, fewer than those allowed the user in their entry in the Protected Password database, prpw(F).


-q
Displays both your kernel privileges and subsystem authorizations in a format suitable for input to other programs. This option is intended for use by system administration scripts that need to know a user's authorizations. The subsystem authorizations listed include all secondary authorizations for the primaries assigned to you (see subsystem(M) for further information about subsystem authorizations).

-s
Reports subsystem authorizations that you have been assigned. You cannot alter these authorizations using auths; they always depend on the real user ID.

-v
Lists the new kernel privileges before the new command or shell is run. Used with -a, this option warns you if you try to set more privileges than already exist. With -r, it warns you if you attempt to remove more privileges than already exist.

Kernel privileges

The kernel privileges are:

chmodsugid
process can set SUID and SGID bits on files

chown
process can change ownership of files it owns

configaudit
process can change audit subsystem parameters

execsuid
allows SUID programs to be run

suspendaudit
process is not audited by the kernel

writeaudit
process can write directly to the audit trail

Subsystem authorizations

A complete description of the subsystem and secondary subsystem authorizations can be found on the authorize(F) manual page.

Examples

List your subsystem authorizations:

auths -s

Execute a shell without the execsuid kernel privileges:

auths -r execsuid

List the current kernel privileges:

auths

Execute yourprog with no kernel privileges:

auths -a "" -c yourprog

Execute myprog with chmodsugid and execsuid:

auths -a chmodsugid,execsuid -c myprog

See also

authorize(F), getpriv(S-osr5), getprpwent(S-osr5), prpw(F), setpriv(S-osr5), sh(C), subsystem(M)

``Using a secure system'' in Using a Secure System

Standards conformance

auths is not part of any currently supported standard; it is an extension of AT&T System V provided by The Santa Cruz Operation, Inc.
© 2005 The SCO Group, Inc. All rights reserved.
SCO OpenServer Release 6.0.0 -- 03 June 2005