Type string READ/WRITE
runchroot emulates the behavior of the system chroot command; that is, it runs a command with a specified root directory. Ordinarily, file names are looked up starting at the root of the directory structure, ('/'). Setting runchroot to a different value changes the root directory, a directory that must exist.
if (basename(runcommand) == "customapplication")
{
runchroot="/home/customapplicationv";
}Type string READ/WRITE
If runcksum is defined, pmlocald verifies the value of this variable against the checksum of the runcommand and rejects the request if it does not match. Set this variable to the value produced by running the pmsum command on the agent with the full pathname of the runcommand.
You can use this method to detect a program that has been changed without authorization, and a program that a user is attempting to run from an unauthorized path.
# Generate a checksum value for the program "/usr/bin/passwd" on the agent:host1
# for use in the policy file on the policy server.
pmsum /usr/bin/passwd
# The pmsum command displays the output:
fbc9cf01 /usr/bin/passwd
# Update the security policy using this checksum:
if (( basename(runcommand) == "passwd" ) && (host == "host1"))
{
runcksum="fbc9cf01";
}Type string READ/WRITE
runclienthost is a modifiable copy of the clienthost input variable.
# reject commands being issued from unknown workstations
workstations = {"sun34","sun35","sun36"};
if (!(clienthost in workstations))
reject;Type string READ/WRITE
runcommand is a modifiable copy of the command input variable. It specifies the pathname of the program that pmlocald will run.
Setting the runcomand can be a useful way of using a pseudonym for a command that an
auditor wants to disguise:
if ( command == "passcmd")
{
runcommand="/usr/bin/passwd"
runargv[0]="passwd";
runargv=replace(runargv,1,length(runargv));
}© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center