Due to weird IOS architectural reasons you need to have full privilege level 15 to do 'show run'.
The modern replacement to various privilege levels is RBAC or Role Based Access Control. Here you can define each user separate view, command by command. You could allow user to do 'show run' and add new permit lines in access-lists in configuration mode, but nothing else.
Nice thing about RBAC is, that user also only sees commands which are allowed, so when she punches in '?', only commands shown to her are the ones previously allowed by operator.
Example configuration:
parser view arbitrary_name
commands ipenacl include permit ip
commands ipenacl include permit
commands configure include ip access-list extended
commands configure include ip access-list
commands configure include ip
commands exec include configure terminal
commands exec include configure
commands exec include all show running-config
commands exec include show
!
username some_user view arbitrary_name secret poop
And how it looks like:
bu.ip.fi#show ?
flash: display information about flash: file system
parser Display parser information
running-config Current operating configuration
bu.ip.fi#show running-config view full | i hostname
hostname bu.ip.fi
bu.ip.fi#configure ?
terminal Configure from the terminal
<cr>
bu.ip.fi#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
bu.ip.fi(config)#?
Configure commands:
do-exec To run exec commands in config mode
exit Exit from configure mode
ip Global IP configuration subcommands
bu.ip.fi(config)#ip ?
Global IP configuration subcommands:
access-list Named access-list
bu.ip.fi(config)#ip access-list extended foo
bu.ip.fi(config-ext-nacl)#?
Ext Access List configuration commands:
<1-2147483647> Sequence Number
exit Exit from access-list configuration mode
permit Specify packets to forward
bu.ip.fi(config-ext-nacl)#