auths performs actions associated with system privilege
manipulation. With no arguments, auths returns the kernel
privileges associated with the current process.
The -a and -r options allow you to alter the
kernel privileges in order to run a shell or a single
command specified as an argument to the -c
option.
auths accepts the following options:
-aauthlist
Specifies a list of comma-separated privileges (authlist)
that become the absolute set of kernel privileges for the new
process. This new set must be a subset of the kernel privileges of
the invoking process. To start a process with a null set of kernel
privileges, use the empty string "".
-rauthlist
Specifies a list of comma-separated privileges (authlist)
that are removed from the privileges set of the invoking process
when forming the kernel privileges for the new process.
Either of the -a or -r options allow you to
alter the kernel privileges in order to run a shell or a single
command. See ``Kernel privileges'' for a list of possible kernel
privileges.
-ccommand
Allows you to run a command that has restricted
privileges. auths passes the command name to the
shell specified in your /etc/passwd entry to be run as a
single command. (The shell must support the -ccommand syntax in the manner of
sh(C).)
If this option is absent (and -a or -r is
specified), the shell is invoked as a process with adjusted
privileges. Exiting the shell will resume execution in the previous
shell and the original kernel privileges will be in effect. This
option may be used to run a command with restricted privileges, that
is, fewer than those allowed the user in their entry in the
Protected Password database,
prpw(F).
-q
Displays both your kernel privileges and subsystem authorizations in
a format suitable for input to other programs. This option is
intended for use by system administration scripts that need to know
a user's authorizations. The subsystem authorizations listed include
all secondary authorizations for the primaries assigned to you (see
subsystem(M)
for further information about subsystem authorizations).
-s
Reports subsystem authorizations that you have been assigned. You
cannot alter these authorizations using auths; they always
depend on the real user ID.
-v
Lists the new kernel privileges before the new command or shell is
run. Used with -a, this option warns you if you try to
set more privileges than already exist. With -r, it warns
you if you attempt to remove more privileges than already exist.
Kernel privileges
The kernel privileges are:
chmodsugid
process can set SUID and SGID bits on files
chown
process can change ownership of files it owns
configaudit
process can change audit subsystem parameters
execsuid
allows SUID programs to be run
suspendaudit
process is not audited by the kernel
writeaudit
process can write directly to the audit trail
Subsystem authorizations
A complete description of the subsystem and secondary subsystem
authorizations can be found on the
authorize(F)
manual page.
Examples
List your subsystem authorizations:
auths -s
Execute a shell without the execsuid kernel privileges: