pbcheck

The pbcheck program processes a policy file and produces a report of syntax or language problems, or an entitlement report. The policy server daemon (pbmasterd) reports any policy file errors to a log file; however, pbcheck should be used to detect errors before you install a policy file on a live system.

With no options, pbcheck performs a run-check on the policy file that is specified in your settings file.

The -c option to check licenses has been retired. Use pbadmin --lic -l for this purpose.

With the -e option, pbcheck produces an entitlement report in CSV format. The output data contains the columns submithost, user, command, argv, runhost, runuser, runcommand, and runargv. When a field has no value, the entitlement report displays an empty string for that field.

The policy file must first be syntactically correct, so you should run pbcheck to check the policy syntax before running pbcheck -e. Because pbcheck -e processes the policy without arguments, you should ensure that the logic of the policy works even if no argument is passed to it.

With the -U, -C, or -H options, pbcheck produces a formatted text entitlement report that is sorted by user, command, or host, respectively. If more than one of these options is specified, then each of the reports is produced, one after the other. Using the -x or --csv2 option, you can export the entitlement data to Microsoft® Excel CSV format.

In CSV format, the resulting data is presented as comma-separated values and contains ASCII-formatted information for the following (in this order):

• Submit host
• User
• Command
• Argv
• Accept/reject/error text
• Run host
• Run user
• Run command
• Run argv
• Iolog (yes/no): Not displayed when detail level is low
• Policy file name: Not displayed when detail level is low
• Policy line number: Not displayed when detail level is low
• Policy Server host: Displayed only when detail level is high
• Dependencies: Displayed only when detail level is high
• Constraints: Semi-colon separated. Displayed only when detail level is high

The fields displayed in this format are displayed as empty quotation marks ("") if they were not specified in the policy; this means they could be any value.

If a field contains Can not evaluate soft … expression in the output, it means the policy was setting the corresponding variable to a value that can be evaluated only at runtime (when running pbrun), such as argv, date, time, and so on.

With the option -H, each submit host is displayed on the top, followed by as many lines as necessary containing the other fields in the same order as above (except the submit host field).

Host: <submithost>
<submitUser> <command> <argv> <Accept/Reject/Error Text> <runHost> <runUser>
   <runCommand> <runArgv> <iolog> <policyName> <policyLineNumber> <masterHost>
   <dependency> <constraints>

With the option -U, each user is displayed on the top, followed by as many lines as necessary containing the other fields in the same order as above (except the user field).

User: <user>
<submitHost> <command> <argv> <Accept/Reject/Error Text> <runHost> <runUser>
   <runCommand> <runArgv> <iolog> <policyName> <policyLineNumber> <masterHost>
   <dependency> <constraints>

With the option -C, each command is displayed on the top, followed by as many lines as necessary containing the other fields in the same order as above (except the command field).

Command: <command>
<submitHost> <submitUser> <argv> <Accept/Reject/Error Text> <runHost>
   <runUser> <runCommand> <runArgv> <iolog> <policyName> <policyLineNumber>
   <masterHost> <dependency> <constraints>

The fields displayed in -H, -U, and -C are displayed as <UNSPECIFIED> if they were not specified in the policy, and means they could have any value.

The fields iolog, policyname, and policyLineNumber are not displayed if detail level is low, and the fields masterhost, dependency, and constraints are displayed only when detail level is high.

The entitlement report mechanism uses a temporary work file before creating the final report. This temporary file is created in the $TMPDIR directory. If the TMPDIR environment variable is not set (or is set to /tmp/), the workfile is written in the /tmp directory.

Temporary files that are owned by root in /tmp are a potential vulnerability. We recommend you set TMPDIR=/var or some other appropriate directory where normal users do not have write access.

Policies that use looping constructs which modify the iterating variable within the loop do not work correctly. Policies that test the contents of argv or runargv may produce incomplete results.

Policies that use data that is known only at an actual run-time (such as the date and argv variables) produce incomplete results. In these cases, warnings and errors use the term soft when referring to variables that cannot be fully evaluated.

If a policy contains conditions that are based on external data sources or on external files that are generated at run time, the entitlements are evaluated as if the conditions are true. The last column (displayed when the --detail option is set to High), Constraint, shows that each row is displayed when a condition is accepted. For example, if the policy checks whether a user belongs to a certain netgroup before accepting the command, the report shows the command for this user as accepted; the Constraint field shows the condition that the user belongs to the netgroup. At runtime, a particular user listed in the report might actually not be part of that netgroup, and therefore gets rejected.

The constraint option enables you to limit the report by using any valid EPM-UL policy language expression.

-c "user=='dba'" -c "host in {'A', 'B'}"

Most user defined functions are not properly processed for entitlement reporting.

pbcheck evaluates a limited set of functions in a constraint when those functions are used against the output variables submithost, user, command, runhost, runuser, and runcommand. The supported functions are basename(), tolower(), and toupper().

Examples of constraints whose function calls are evaluated are:

• basename(command) in Allowed_Cmds
• tolower(user) in Allowed_Users
• toupper(submithost) in Allowed_Hosts

All other functions are not evaluated, and do not show actual values for the affected output field.

gsub("^.*/", "", command) in Allowed_Cmds

The -b (--nobasename) option for pbcheck has been deprecated because pbcheck now evaluates the basename() function.

Syntax

• Version 3.5 and earlier: long command options not supported.
• Version 4.0 and later: long command options supported.

pbcheck [options] [command [arguments]]
   -f, --file=file_name
   -h, --host=host_name
   -r, --run
   -s, --syntax
   -t, --type
   -x, --csv2
   -p, --policydir=directory
   -L, --showlists[=listname [,listname]...]
   -S, --showduplicates
pbcheck [options] [-c constraint [-c constraint]...] [command [arguments]]
   -f, --file=file_name
   -p, --policydir=directory
      -e,--entitlement [=abridged|standard|extended| exhaustive]
      -b, --nobasename
      -l, --uselistnames[=columnname[,columnname]...]
   --maxchildren <number>
   --maxloopchildren <number>
   -U, --user_report
   -H, --host_report
   -C, --command_report
   -D, --detail[=low|medium|high]
   -d, --display_headers
   -A, --accepted
   -R, --rejected
   -I, --rejected_implicit
   -c, --constraint=expression
   -x, --csv2
pbcheck -v | --version
pbcheck --help

Arguments

Files

EPM-UL policy file

pbcheck –f /etc/pb.mainconfig