Go to main content

Securing Users and Processes in Oracle® Solaris 11.4

Exit Print View

Updated: September 2018
 
 

Privileges Reference

Privileges restrict processes are implemented in the kernel, and can restrict processes at the command, user, role, or system level.

Commands for Handling Privileges

The following table lists the commands that are available to handle privileges.

Table 5  Commands for Handling Privileges
Purpose
Command
Man Page
Set and list default and limit privileges on a system.
svccfg -s account-policy
Debug privilege failure
ppriv -eD failed-operation
List the privileges on the system
ppriv -l
List a privilege and its description
ppriv -lv priv
List extended privilege policy on a UID, process, or port
ppriv -lv extended-policy
Examine process privileges
ppriv -v pid
Add extended privilege policy to a UID, process, or port
ppriv -r rule
Set process privileges
ppriv -s spec
Remove an extended privilege policy rule
ppriv -X rule
Assign privileges to a rights profile
profiles -p profile-name
Assign privileges to a new role
roleadd -K defaultpriv=
Add privileges to an existing role
rolemod -K defaultpriv+=
Assign privileges to a new user
useradd -K defaultpriv=
Add privileges to an existing user
usermod -K defaultpriv+=
Add device policy to a device
add_drv -p policy driver
Set device policy
devfsadm
View device policy
getdevpolicy
Update device policy on open devices
update_drv -p policy driver

SMF Stencil That Contains Privilege Information

    The account-policy SMF stencil contains and sets the following privilege information:

  • default_privileges – Inheritable set of privileges for the system

  • limit_privileges – Limit set of privileges for the system

  • syslog – System logging file

    The path for debug messages is set in the priv.debug entry.

Privileged Actions in the Audit Record

    Privilege use can be audited. Any time that a process uses a privilege, the use of privilege is recorded in the audit trail in the upriv audit token. When privilege names are part of the record, their textual representation is used. The following audit events record use of privilege:

  • AUE_SETPPRIV audit event – Generates an audit record when a privilege set is changed. The AUE_SETPPRIV audit event is in the pm class.

  • AUE_MODALLOCPRIV audit event – Generates an audit record when a privilege is added from outside the kernel. The AUE_MODALLOCPRIV audit event is in the ad class.

  • AUE_MODDEVPLCY audit event – Generates an audit record when the device policy is changed. The AUE_MODDEVPLCY audit event is in the ad class.

  • AUE_PFEXEC audit event – Generates an audit record when a call is made to execve() with pfexec() enabled. The AUE_PFEXEC audit event is in the as, ex, ps, and ua audit classes. The names of the privileges are included in the audit record.

The successful use of privileges that are in the basic set is not audited. An attempt to use a basic privilege that has been removed from a user's basic set is audited.

For per-privilege auditing, see What’s New in the Audit Service in Oracle Solaris 11.4 in Managing Auditing in Oracle Solaris 11.4.