Chat now with support
Chat with Support

Privilege Manager for Unix 6.1.1 - Administration Guide for Unix

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Planning Deployment Installation and Configuration Upgrade Privilege Manager for Unix System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager programs Installation Packages

umask

Description

Type integer READONLY

umask contains the value of the submit user's umask value. See the umask man page for details.

Example
if (umask == 077) 
{ 
   printf("Do not create files with permissions 0777\n"); 
   runumask =0666; 
}
Related Topics

runumask

unameclient

Description

Type list READONLY

unameclient contains the system uname information from the client host. This information corresponds to the list returned by uname. For example:

  • operating system name
  • nodename
  • operating system release level
  • operating system version
  • machine hardware name

uniqueid

Description

Type string READONLY

uniqueid is a 12-character string identifying a session. This is guaranteed to be unique on one policy server machine.

Example
printf("Command is running as id = %s", uniqueid);

use_rundir

Description

Type string READONLY

use_rundir is a read-only variable containing the value "!~!". You can use it as a placeholder in the context of any runtime variable to represent the runuser's home directory, as defined on the runhost. pmlocald replaces any instances of this value found in any runtime variable with the runuser's home directory on the runhost.

Example
allowedrequestusers={"root", "admin", "oradmin"}; 
//if requestuser is in allowed list, set runuser to requestuser 
  and set groups to match primary group on the runhost, 
//and change directory to runuser's home dir 
if (requestuser in allowedrequestusers) 
{ 
   runuser=requestuser; 
   rungroup=use_rungroup; 
   rungroups= {use_rungroup}; 
   runcwd = use_rundir; 
   accept; 
}
Related Documents