auths(C)

auths -- list and/or restrict kernel privileges

Syntax

auths [ -v ] [ -c command ] [ -a authlist | -r authlist ]
auths [ -q ]
auths [ -s ]

Description

auths performs actions associated with system privilege manipulation. With no arguments, auths returns the kernel privileges associated with the current process.

The -a and -r options allow you to alter the kernel privileges in order to run a shell or a single command specified as an argument to the -c option.

auths accepts the following options:

-a authlist: Specifies a list of comma-separated privileges (authlist) that become the absolute set of kernel privileges for the new process. This new set must be a subset of the kernel privileges of the invoking process. To start a process with a null set of kernel privileges, use the empty string "".
-r authlist: Specifies a list of comma-separated privileges (authlist) that are removed from the privileges set of the invoking process when forming the kernel privileges for the new process.

Either of the -a or -r options allow you to alter the kernel privileges in order to run a shell or a single command. See ``Kernel privileges'' for a list of possible kernel privileges.

-c command: Allows you to run a command that has restricted privileges. auths passes the command name to the shell specified in your /etc/passwd entry to be run as a single command. (The shell must support the -c command syntax in the manner of sh(C).)
If this option is absent (and -a or -r is specified), the shell is invoked as a process with adjusted privileges. Exiting the shell will resume execution in the previous shell and the original kernel privileges will be in effect. This option may be used to run a command with restricted privileges, that is, fewer than those allowed the user in their entry in the Protected Password database, prpw(F).
-q: Displays both your kernel privileges and subsystem authorizations in a format suitable for input to other programs. This option is intended for use by system administration scripts that need to know a user's authorizations. The subsystem authorizations listed include all secondary authorizations for the primaries assigned to you (see subsystem(M) for further information about subsystem authorizations).
-s: Reports subsystem authorizations that you have been assigned. You cannot alter these authorizations using auths; they always depend on the real user ID.
-v: Lists the new kernel privileges before the new command or shell is run. Used with -a, this option warns you if you try to set more privileges than already exist. With -r, it warns you if you attempt to remove more privileges than already exist.

Kernel privileges

The kernel privileges are:

chmodsugid: process can set SUID and SGID bits on files
chown: process can change ownership of files it owns
configaudit: process can change audit subsystem parameters
execsuid: allows SUID programs to be run
suspendaudit: process is not audited by the kernel
writeaudit: process can write directly to the audit trail

Subsystem authorizations

A complete description of the subsystem and secondary subsystem authorizations can be found on the authorize(F) manual page.

Examples

List your subsystem authorizations:

auths -s

Execute a shell without the execsuid kernel privileges:

auths -r execsuid

List the current kernel privileges:

auths

Execute yourprog with no kernel privileges:

auths -a "" -c yourprog

Execute myprog with chmodsugid and execsuid:

auths -a chmodsugid,execsuid -c myprog

Standards conformance

auths is not part of any currently supported standard; it is an extension of AT&T System V provided by The Santa Cruz Operation, Inc.