This example demonstrates how you can set up a particular job's run-time operating environment with Privilege Manager for Unix. Although the policy fragments shown below are arbitrary, you can use similar fragments to implement your own policies.

Type the following fragment into the /etc/opt/quest/qpm4u/policy/pm.conf file, or copy it from the examples directory in the Privilege Manager for Unix distribution directory. Replace "dan" and "robyn" with users from your site.

Do not type in the line numbers.

1 # Run-time example configuration file 
2    adminusers={"dan", "robyn"}; 
3    adminprogs={"ls", "hostname", "kill", "csh", "ksh", "echo"}; 
4    if(user in adminusers && command in adminprogs) { 
5       if(!(cwd=="/usr" || glob("/usr/*", cwd)) 
6          runcwd="/tmp"; 
7       if(argc > 2) 
8          runargv=range(argv, 0, 2); 
9    runuser="root"; 
10    rungroup="bin"; 
11    if(command!="hostname") 
12       runhost=submithost; 
13    keepenv("TERM", "DISPLAY", "HOME", "TZ", "PWD", "WINDOWID", "COLUMNS", "LINES"); 
14    setenv("PATH", "/usr/ucb:/bin:/usr/bin:/usr/local/bin:/usr/bin/X11:" + 
15    "/usr/X11/bin:/usr/etc:/etc:/usr/local/etc:/usr/sbin"); 
16    safeshells={"/bin/sh", "/bin/csh", "/bin/ksh"}; 
17    if(getenv("SHELL") in safeshells) 
18       setenv("SHELL", getenv("SHELL")); 
19    else 
20       setenv("SHELL", "/bin/sh"); 
21    runumask=022; 
22    runnice=-4; 
23    accept; 
24    }

The following describes the results of this example:

• Lines 5, 6

  These lines designate in which directory the job will run. Line 5 checks the current working directory: if the cwd variable is /usr or if it glob-matches "/usr/*", the request will run under that directory. If not, the request will run in /tmp.

• Lines 7, 8

  In this example, no more than two arguments are allowed to be specified to the requested command. The range function in line 8 returns all arguments and only the first three elements of the argv list (element 0, which is the command name; element 1, the first argument; and element 2, the second argument).

• Line 9

  This line causes the request to run as root.

• Line 10

  This line causes the request to run as the bin group.

• Line 11, 12

  These lines specify that if the command is not hostname, run it on the machine from which the request was submitted. If the command is hostname, run it on whatever machine the user wishes. (By default, it will run on the machine from which the request was submitted; you can change this using the -h argument to pmrun.)

• Line 13

  First, line 13 deletes all environment variables, except those specified in the keepenv list. Since you can use environment variables to exploit security holes in UNIX programs and shell scripts, be careful when specifying the environment variables for a request.

• Line 14

  This line sets the PATH variable explicitly to include only safe directories. Note the use of the + operator to concatenate the values assigned to the PATH variable; + splits the values over two lines to avoid ugly end-of-line wrapping.

• Line 15-19

  This fragment ensures that the SHELL variable is only set to a safe value. If the existing SHELL variable is already set to one of the values defined as "safe" in safeshells, then that value is used. If not, then the SHELL is set to /bin/sh.

  Note that getenv reads from the env variable; setenv and keepenv write to the runenv variable.

• Line 20

  This line sets the command's umask value to 022: data files created by the command will have rw-r--r-- permissions, and directories will have rwxr-xr-x permissions. Since the command will run under the root account, root will own the files.

  Specify a leading zero when typing in umask values so they are interpreted as octal numbers.

• Line 21

  The command will run with a nice value of -4, which gives it a high priority relative to other jobs on the system.

• Line 22

  After setting up the job’s environment, the request is accepted and the job is run.

Check the configuration file for errors with pmcheck. For more information about using pmcheck, see Example 1: Basics.

Try running your favorite shell, for example:

# pmrun csh

In the shell, you can then enter env to list the environment variables, pwd to print the working directory in which your request ran, or umask to display the umask value.