Rules provide the means by which you can control commands. Commands can be authorized to run, or not authorized to run, by setting rule conditions based on different criteria:
The command being submitted
The user and host submitting the command
The user and host assigned to run the command
The time the command is submitted
The contents of Perl scripts you have defined.
See Setting Conditions for a Rule for details.
If a rule’s conditions are met, there are a number of options you can set to determine how the rule processes the command. You can configure a rule to:
Display a message to the user submitting the command
Capture the user session for reporting and auditing purposes
Authorize or not authorize the command to be run
Specify what further rule processing to do. The rule can specify that the processing of additional rules ends by using the stop conditions (Stop, Stop if authorized, Stop if unauthorized).
When the Framework Manager receives a command request, the evaluation starts at the top of the rule tree. Even when a request matches a rule, the evaluation continues until a rule has a stop condition or the rule tree has been processed.
You can also:
Specify the user and host to run the command
Set a risk level for use with keystroke reports
Assign an audit group to the rule for use with the Compliance Auditor.
See Modifying a Rule for details.
You can also create and assign Perl scripts to the rule to provide additional functionality. See Adding a Script and Assigning a Script to a Rule for details.
NOTE:If you are using a different user (run user) to run an authorized command than the user who submitted the command (submit user), by default the submit user’s environment variables are used for the run user. If you want to use the environment variables associated with the run user, you can add a script to a rule containing the following text:
$meta->get_params("Job")->arg("job_default_env",0);
return 1;