When to Use Privileges

To know if your application can run without privilege, you need to know what tasks use which privileges and when those privileges are needed. The following guidelines are to help you determine what privileges (if any) an application might need.

• Applications that perform no special tasks and operate within the mandatory access, discretionary access, and ownership controls of the system do not require privilege.

• Application tasks that require read, write, execute, or search access to an object require privilege when the process does not have discretionary or mandatory access. If a process does not have the access or the needed privilege, the external variable errno is set to EACCES or ESRCH.The privileges to correct the error are listed under the EACCES or ESRCH errors on the man page.

• Application tasks that modify an object in a way that only the owning process can modify it require privilege if the modifying process does not own the object. If a process does not own the object or have the proper privilege, the external variable errno is set to EPERM. The privileges to correct the error are listed in the Description section and under the EPERM error on the man page.

• Some application tasks always require privilege even when discretionary and mandatory access are allowed. Setting privileges on an executable file or redirecting console output to another device are two examples of such tasks. If a process does not have the privilege for such a task, the external variable errno is set to EPERM. The privileges to correct the error are listed in the Description section and under the EPERM error on the man page.

See Appendix A, Programmer's Reference for information on how to access man pages to obtain information on privileges and privilege descriptions.