Privileged Groups

A "privilege" is the ability to ignore access restrictions and change restrictions imposed by security policy and implemented in an access control mechanism. On HP-UX, only system administrators and members of certain groups are the only privileged users.

The system administrator can associate a group with a system capability so that members of certain groups can be granted special privileges. The groups are called privileged groups.

All users by default are members of the CHOWN privilege group. People with this privilege can change the ownership of files they don't own. The system administrator may limit access to the chown(1) command by setting up privileged groups using setprivgrp(1M). In that case, only those in the privileged group or groups can change file ownership using chown(1). Refer to the chown(1) man page for more information.

Users can also execute the getprivgrp(1) command to determine the special attributes for groups to which they belong. If the groupname is omitted, the command lists the access privileges.

	NOTE: PRIV_SETRUGID is a special privilege group which has been provided for backwards compatibility. It may present a security problem and should not be used.