Privilege configuration on cisco switch

Question

I have a Cisco switch who have an user configured with privilege level 3 configured as below

! the user can configure an interface 
privilege configure level 3 interface
privilege exec level 3 configure terminal
privilege exec level 3 configure

I wonder how can I get him the privilege to execute the following command.

the goal :

copy run tftp:XXX

by curiosity :

show run               

EDIT: I found the answer for the first copy run tftp:XXX add the following command

privilege exec level 3 copy

If anyone know how to view the show run will be great.

Answer 1

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml probably answers your question:

privilege exec level 3 show running 

Answer 2

Due to weird IOS architectural reasons you need to have full privilege level 15 to do 'show run'.

The modern replacement to various privilege levels is RBAC or Role Based Access Control. Here you can define each user separate view, command by command. You could allow user to do 'show run' and add new permit lines in access-lists in configuration mode, but nothing else.
Nice thing about RBAC is, that user also only sees commands which are allowed, so when she punches in '?', only commands shown to her are the ones previously allowed by operator.

Example configuration:

parser view arbitrary_name
 commands ipenacl include permit ip
 commands ipenacl include permit
 commands configure include ip access-list extended
 commands configure include ip access-list
 commands configure include ip
 commands exec include configure terminal
 commands exec include configure
 commands exec include all show running-config
 commands exec include show
!
username some_user view arbitrary_name secret poop

And how it looks like:

bu.ip.fi#show ?
  flash:          display information about flash: file system
  parser          Display parser information
  running-config  Current operating configuration

bu.ip.fi#show running-config view full | i hostname
hostname bu.ip.fi
bu.ip.fi#configure ?
  terminal  Configure from the terminal
  <cr>

bu.ip.fi#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
bu.ip.fi(config)#?
Configure commands:
  do-exec  To run exec commands in config mode
  exit     Exit from configure mode
  ip       Global IP configuration subcommands

bu.ip.fi(config)#ip ?
Global IP configuration subcommands:
  access-list  Named access-list

bu.ip.fi(config)#ip access-list extended foo
bu.ip.fi(config-ext-nacl)#?
Ext Access List configuration commands:
  <1-2147483647>  Sequence Number
  exit            Exit from access-list configuration mode
  permit          Specify packets to forward

bu.ip.fi(config-ext-nacl)#

Answer 3

Thanks to @Teun Vink for finding the link that addresses this point. If you carefully read the document, you will find that merely adding the privilege exec level 3 show running command will not allow the user to see very much of the actual configuration. Cisco limits the amount of the config that you can see based on your privilege level, and the commands available at that level, for security purposes.

If you grant the user privilege exec level 3 show config , he/she will be permitted to view the last configuration that was saved to memory, which may differ from the current running-config.