Developer's Guide to Oracle Solaris Security

Privilege Interfaces

The following table lists the interfaces for using privileges. Descriptions of some major privilege interfaces are provided after the table.

Table 2–1 Interfaces for Using Privileges



Additional Comments 

Getting and setting privilege sets 

setppriv(2), getppriv(2), priv_set(3C), priv_ineffect(3C)

setppriv() and getppriv() are system calls. priv_ineffect() and priv_set() are wrappers for convenience.

Identifying and translating privileges 

priv_str_to_set(3C), priv_set_to_str(3C), priv_getbyname(3C), priv_getbynum(3C), priv_getsetbyname(3C), priv_getsetbynum(3C)

These functions map the specified privilege or privilege set to a name or a number.  

Manipulating privilege sets 

priv_allocset(3C), priv_freeset(3C), priv_emptyset(3C), priv_fillset(3C), priv_isemptyset(3C), priv_isfullset(3C), priv_isequalset(3C), priv_issubset(3C), priv_intersect(3C), priv_union(3C), priv_inverse(3C), priv_addset(3C), priv_copyset(3C), priv_delset(3C), priv_ismember(3C)

These functions are concerned with privilege memory allocation, testing, and various set operations. 

Getting and setting process flags 

getpflags(2), setpflags(2)

The PRIV_AWARE process flag indicates whether the process understands privileges or runs under the superuser model. PRIV_DEBUG is used for privilege debugging. 

Low-level credential manipulation 


These routines are used for debugging, low-level system calls, and kernel calls. 

setppriv(): for Setting Privileges

The main function for setting privileges is setppriv(), which has the following syntax:

int setppriv(priv_op_t op, priv_ptype_t which, \
const priv_set_t *set);

op represents the privilege operation that is to be performed. The op parameter has one of three possible values:

which specifies the type of privilege set to be changed, as follows:

set specifies the privileges to be used in the change operation.

In addition, a convenience function is provided: priv_set().

priv_str_to_set() for Mapping Privileges

These functions are convenient for mapping privilege names with their numeric values. priv_str_to_set() is a typical function in this family. priv_str_to_set() has the following syntax:

priv_set_t *priv_str_to_set(const char *buf, const char *set, \
const char **endptr);

priv_str_to_set() takes a string of privilege names that are specified in buf. priv_str_to_set() returns a set of privilege values that can be combined with one of the four privilege sets. **endptr can be used to debug parsing errors.

Note that the following keywords can be included in buf: