Users submit their requests to run certain programs as root, or another privileged account, through Privilege Manager for Unix using pmrun. The policy server daemon, pmmasterd, examines each request from pmrun, and either accepts or rejects it based upon the policies specified in the policy file.

The Privilege Manager for Unix configuration file (also referred to as the pmpolicy security policy) contains the security policy that the policy server master daemon (pmmasterd) considers when it accepts or rejects user requests. The configuration file can specify constraints based on certain attributes, such as:

• Username

• Group membership

• Application name

• Application arguments

• Environment variable values

• Umask (file permissions)

• Nice value (priority of jobs run)

• Working directory from which the request may be made

• Host from which a request can be submitted (submitting host)

• tty from which a request is submitted

• Host from which the request will be run (execution host)

• A remote, dedicated host to store iologs and/or eventlogs

• Time of day and day of week that the user is allowed to run the application

• Exit status or output of any specified program to be run as part of the decision-making process

• A challenge to the user to type in one or more specified user passwords (requires on-the-spot approval from those users, such as supervisors or managers)

• Whether the program being requested has a checksum that matches the one stored for that application in the configuration file (protects against possible virus or trojan horse attack)

• Store all information for each request in a log file

• Record all keystrokes and/or output in a dribble file

• Some other miscellaneous job properties

If Privilege Manager for Unix accepts the request, the Privilege Manager for Unix local daemon (pmlocald) runs the application program as the runuser selected in the policy file, piping all input/output back to the user’s terminal. In addition, you can specify in the configuration file that you want to store all information for each request in a log file, and optionally record all keystrokes, output, or both, in an I/O file for later replay. You can replay the file in real time, so you can observe the commands as they are issued.

You can restrict responses to a small designated range of reserved port numbers by setting parameters in /etc/opt/quest/qpm4u/pm.settings. This enhances the security of communications between pmlocald and pmmasterd when the two must communicate across a firewall. For more details, see PM settings variables.

Privilege Manager for Unix utilizes NAT (Network Address Translation) to further restrict responses to a single designated port when pmlocald and pmmasterd must communicate across a firewall.

You can issue commands either in the foreground or background. If you run them in the background, you can continue to use the same shell process to issue additional commands. For more details, see Privilege Manager for Unix shells.

The policy file is:

• Located on the policy server daemon host

• Created in pm.conf

  By default, the policy file is named pm.conf and is located in the directory specified by policyfile. If the full path name for the pm.conf file is not specified in policyfile, the path is relative to policydir.

• Owned by root

Only root can have write permission for the configuration file. Otherwise, a user might gain illegal access to the root account through modification of the file. To prevent someone from replacing the entire /etc directory or its contents, both / and /etc have permission modes that do not allow users to modify them.

The configuration file contains statements and declarations in a language specifically designed to express policies concerning the use of root and other controlled accounts.

For example, if your policy is: Allow user robyn to run the /bin/passwd program as root on the galileo machine Monday through Friday, during office hours (8:00 a.m. to 5:00 p.m.), add the following to your policy file:

weekdays={"Mon", "Tue", "Wed", "Thu", "Fri"}; if (user=="robyn" && command=="passwd" && host=="galileo" && timebetween(800, 1700) && dayname in weekdays) { runuser="root"; runcommand="/bin/passwd"; accept; }

Do not use a leading zero for any time between 00:00 and 9:59 a.m. For example, when specifying 7:00 a.m., use 700 rather than 0700. Specify 12:30 am as 30 or 2430. Privilege Manager for Unix interprets numbers with leading zeroes as octal numbers: 0700 octal is 560 decimal, which is not a valid time.