Applications That Check for Privileges

Privileged applications can check for the use of privileges. The RBAC rights profile mechanism enables you to specify the privileges for specific commands. Instead of requiring superuser capabilities to use an application or command, you can isolate the command with execution security attributes in a rights profile. A user or role with that rights profile can then run the command with just the privileges that the command requires to succeed.

Commands that check for privileges include the following:

• Kerberos commands, such as kadmin, kprop, and kdb5_util

• Network commands, such as ifconfig, routeadm, and snoop

• File and file system commands, such as chmod, chgrp, and mount

• Commands that control processes, such as kill, pcred, and rcapadm

To add commands with privileges to a rights profile, see How to Create or Change a Rights Profile. To determine what commands check for privileges in a particular profile, see Determining Your Assigned Privileges.