Using Commands with Platform Agent

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

This page gives examples and details about the commands that can be specified as part of a Granular Privilege Elevation PCS policy when using the Platform Agent. For an overview and step-by-step instructions on how to create this type of policy, see Setting Up Policies (Platform Agent).

This page gives information relevant to the Platform Agent. For information about the other type of agent, Privilege Control Agent, see Privilege Control Agent.

Controlling Access to Commands

In a standard Linux environment, an ordinary user account can execute a large number of common command-line programs without any special privileges, but one or more administrative accounts, such as root, are required to execute commands that perform privileged operations. If ordinary users need to execute any of the commands requiring administrative privileges, they might have to switch to an administrative account that requires them to know the password for a privileged user, or they might be granted access by configuration settings in a sudoers file. A Granular Privilege Elevation policy makes it easier to grant this sort of access. You can grant certain users permission to execute commands that would otherwise require administrative or root privileges.

For computers managed by the Platform Agent, however, you can define command access rights to tightly control the specific commands users can execute. You can also refine those rights to only allow specific arguments to be used or to require an executable to be located in a specific directory.

There are no predefined rights for commands. Therefore, only the specific command access rights you define will be available for you to add to roles.

What Command Rights Provide

Command access rights identify the specific commands that can be executed on a Windows or Linux computer by a user. Command rights also specify whether the commands defined in the right are executed under the user’s own account or using another user account or group.

There are two primary reasons for defining command rights:

• To grant access to specific commands that must be executed with elevated privileges.

• To restrict access to only allow specific commands to be executed.

Granting Access Using Commands

The most common reason for creating command rights is to allow users to execute commands that require privileges not granted to a standard user account. For example, you might want to grant some users permission to run command-line programs that require root privileges to better manage their own computers.

With this type of command right, most commands are executed in the default shell environment with ordinary user privileges. When users on endpoints with a Granular Privilege Elevation policy want to use their elevated privileges, they invoke the command they have been granted access to; for example, using the sudo command on Linux.

Examples of Windows Elevated Privilege Commands and Apps

The following table shows examples of Windows elevated privilege commands and applications, which you could include in a command set entitled "Windows Management Tools" or something similar:

Privilege Elevation Command Name	Application and Arguments	Path
Server Manager	ServerManager.exe	Standard system path
Service Control Manager	sc.exe	Standard system path
Microsoft Management Console (MMC)	mmc.exe	Standard system path

Examples of Linux Elevated Privilege Commands and Apps

The following table shows examples of Linux elevated privilege commands and applications you could include in a command group named "Linux commands" or something similar.

In these command definitions, glob pattern matching is used to expand any wildcard expressions. For more information, see About Glob Expressions.

Privilege Elevation Command Name	Command	Argument	Match Path	Description
Edit SSH server config	vi	/etc/ssh/sshd_config	Standard user path	Allows the user to edit the SSH server's config file, but nothing else
Edit SSH	vi	/etc/ssh/\*_config	Standard user path	Allows the user to edit any SSH-related configuration
Change firewall	iptables	-A INPUT -s \* -j ACCEPT	Standard system path	Allows the user to change Linux firewall rules so specified hosts can make network connections
Restart PostgreSQL	systemctl	restart pgsql	Standard system path	Allows the user to restart the PostgreSQL service
View commands	sudo	-l	Standard system path	Allows the user to see a list of commands the user can run on the machine

When you add or modify privilege elevation commands, you can also specify which user accounts the commands will run as. The Root user is the default. You can add one or more users by adding it under Run Command As.

About Linux Match Paths

When you specify a match path, you can select one of the following options:

• Standard system path
• Standard user path
• System search path
• Specify path

Each match path maps to one or more of the binary directories on Linux systems as follows:

Path Setting	Included Directories
System Path	/sbin, /usr/sbin
User Path	/bin, /usr/bin
Search Path	/sbin, /usr/sbin, /bin, /usr/bin

Linux uses each directory for a specific purpose, as follows (text from Linux help output):

• /bin: For binaries usable before the /usr partition is mounted. This /bin directory is used for trivial binaries used in the very early boot stage or ones that you need to have available in booting single-user more; for example, binaries such as cat, ls, and so on.

• /sbin: Same as /bin, but for binaries that require superuser (root) privileges.

• /usr/bin: Same as /bin, but for general system-wide binaries.

• /usr/sbin: Same as /bin, but for binaries with superuser (root) privileges required.

About Glob Expressions

Glob pattern matching is text matching. For example, if you do a glob pattern search for "app" it returns anything with the exact name of "app". Typically, people use glob pattern matching in Linux shells or the Windows command window.

The glob standard gives special meaning to a few characters:

Glob Character	Description	Example Pattern	Example Results
* (asterisk)	Matches any number of characters, including zero	app\*	application apple app
		b\*d	bad bud bid bGd bland before we sighted land
? (question mark)	Matches any one character	b?d	bad bud bid bGd
[ ] (brackets)	Can contain any number of characters and matches exactly one character if it's contained between the brackets.	the\*brown\*f?x j[au]\*	the quick brown fox jumps the sly, silly brown fox jabbered

For the complete documentation for the glob standard, see https://man7.org/linux/man-pages/man7/glob.7.html.