PRIV(1)

NAME
priv - execute commands as a different user

SYNOPSIS
priv command [arguments ]

DESCRIPTION
priv allows authorised users to execute commands that run as different users.

When priv is invoked, it reads a list of authorised commands from a database file called /usr/pkg/etc/priv/username. Each line of the database file is a colon-seperated list of fields. The first two fields must be specified. Blank lines or lines beginning with a ``#'' character are ignored. The fields, in order, are:

    expiry date
    user name to run command as
    flags
    command name

The format of the expiry date is YYYYMMDDhhmm. A date of ``0'' is interpreted as no expiry date.

The flags field is an integer that contains the following bits:

    F_SETUID 0000001 allow set-[gu]id programs to run
    F_SYMLINK 0000002 allow symlink as command run
    F_BASENAME 0000004 only check basename of command
    F_LOGLS 0000010 do an 'ls' of the command run
    F_LOGCWD 0000020 log working directory
    F_LOGCMD 0000040 log full command name
    F_LOGTTY 0000100 log user's terminal
    F_BINPATH 0000200 allow any command in given path
    F_GIVEREASON 0000400 ask for reason for running priv
    F_CLEANENV 0001000 reset environment first
    F_SU 0100000 check su to an account

The F_SU flag enables priv to authorise an su(8) command. In this case, the user name field is the user to su to, and the command name is ignored. There should be a link from either su<user> or su-<user> to perform an ``su user'' or ``su - user'' as required. If ``-c command'' is given as arguments to this, then it is appended to the su command line.

The command name may either be a fully qualified path name, or the command will be run from the user's path. If the command name is left blank, then the user is allowed to run any command. If there is a blank command line in the database file, it should be placed last.

If the F_BINPATH flag is given, then the command name in the configuration file will be taken as a directory from which any command is valid. If F_BASENAME is also given, the fully qualified path name won't be necessary.

The following security precautions are taken before execve(3)ing command:

1.  All file descriptors except 0 (stdin), 1 (stdout) and 2 (stderr) are closed.

2.  All signal handling is reset to the default handlers (refer to signal(3)).

3.  If F_CLEANENV is specified, all environment variables are discarded, and the following are defined:

    COLUMNS and LINES: set to the original values of COLUMNS and LINES (respectively) if they only contain numbers. Otherwise discarded.

    HOME: set to the home directory of the target user.

    IFS: set to space, tab and newline.

    LOGNAME and USER: set to the username of the target user.

    ORIG_HOME, ORIG_LOGNAME and ORIG_USER: set to the original values of HOME, LOGNAME and USER respectively.

    PATH: set to /bin:/usr/bin.

    PRIVCMD: set to the command that was executed.

    SHELL: set to /bin/sh.

    TERM: set to the original value of TERM if it only contains characters in the set [0-9a-zA-Z-+_.]. Otherwise set to dumb.

priv logs all activity via syslog(3) using the LOG_AUTH facility. All failures contain the string ``not ok'' .

FILES
/usr/pkg/etc/priv
    The database directory.

SEE ALSO
execve(3), signal(3), su(1)

BUGS
When priv searchs the PATH environment variable for a command to run, the checks are made as the effective user that priv runs as (root). Be aware of this when setting permissions on a program.

AUTHORS
Simon Burge <simonb@telstra.com.au> wrote this version of priv, with various enhancements provided by Luke Mewburn <lukem@connect.com.au>.

HISTORY
A command called priv was written by Ron Kuris in December 1988, and later modified by Dan Busarow, DPC Systems, in November 1991.

This version of priv bears little resemblence to the original command, but keeps the same name because Simon likes it.

Some features (such as F_CLEANENV) were inspired by similar functionality in super, which was written by Will Deich <will@astro.caltech.edu>.