Movatterモバイル変換

prof_attr

- profile description database

Synopsis

/etc/security/prof_attr

Description

/etc/security/prof_attr is a local source for execution profile names, descriptions, and otherattributes of execution profiles. Theprof_attr file can be used with otherprofile sources, including theprof_attr NIS map. Programs use thegetprofattr(3C) routines togain access to this information.

The search order for multipleprof_attr sources is specified in the/etc/nsswitch.conffile, as described in thensswitch.conf(4) man page.

An execution profile is a mechanism used to bundle together the commandsand authorizations needed to perform a specific function. An execution profile canalso contain other execution profiles. Each entry in theprof_attr database consistsof one line of text containing five fields separated by colons (:). Linecontinuations using the backslash (\) character are permitted. The format of eachentry is:

profname:res1:res2:desc:attr

profname

The name of the profile. Profile names are case-sensitive.

res1

The charactersRO in this field indicate it is read only and not modifiable by the tools that update this database.

res2

Reserved for future use.

desc

A long description. This field should explain the purpose of the profile, including what type of user would be interested in using it. The long description should be suitable for displaying in the help text of an application.

attr

An optional list of semicolon-separated (;) key-value pairs that describe the security attributes to apply to the object upon execution. Zero or more keys can be specified. The following keys are currently interpreted by the system:

help is assigned the name of a file ending in.htm or.html.

auths specifies a comma-separated list of authorization names chosen from those names defined in theauth_attr(4) database. Authorization names can be specified using the asterisk (*) character as a wildcard. For example,solaris.printer.* would mean all of Sun's authorizations for printing.

audit_flags specifies per-user Audit preselection flags as colon-separated always-audit-flags and never-audit-flags. For example,audit_flags=always-audit-flags:never-audit-flags. Seeaudit_flags(5).

profiles specifies a comma-separated list of profile names chosen from those names defined in theprof_attr database.

privs specifies a comma-separated list of privileges names chosen from those names defined in thepriv_names(4) database. These privileges can then be used for executing commands withpfexec(1).

defaultpriv andlimitpriv have the same semantics as inuser_attr(4). If they are not specified in theuser_attr database, the assigned profiles are searched until a match is found.

audit_flags specifies per-user audit preselection flags as a colon-separated list ofalways-audit-flags andnever-audit-flags values, for example,audit_flags=always-audit-flags:never-audit-flags. Seeaudit_flags(5).

Examples

Example 1 Allowing Execution of All Commands

The following entry allows the user to execute all commands:

All:::Use this profile to give a :help=All.html

Example 2 Consulting the Localprof_attr File First

With the followingnsswitch.conf entry, the localprof_attr file is consulted beforethe NIS map:

prof_attr: files nis

Files

/etc/nsswitch.conf
/etc/security/prof_attr: Locally added entries. Make sure that the shipped header remains intact.
/etc/security/prof_attr.d/*: Entries added by package installation.

Notes

The root user is usually defined in local databases because root needsto be able to log in and do system maintenance in single-usermode and at other times when the network name service databases arenot available. So that the profile definitions for root can be locatedat such times, root's profiles should be defined in the localprof_attr file,and the order shown in the examplensswitch.conf(4) file entry under EXAMPLES ishighly recommended.

Because the list of legal keys is likely to expand, any codethat parses this database must be written to ignore unknown key-value pairswithout error. When any new keywords are created, the names should beprefixed with a unique string, such as the company's stock symbol, toavoid potential naming conflicts.

Each application has its own requirements for whether thehelp value mustbe a relative pathname ending with a filename or the name ofa file. The only known requirement is for the name of afile.

The following characters are used in describing the database format and mustbe escaped with a backslash if used as data: colon (:), semicolon(;), equals (=), and backslash (\).

The following authorizations are required to set various fields:

prof        namename of profile        solaris.profile.managedesc        description of profile     solaris.profile.managehelp        html help file name        solaris.profile.manage            of profileauths       authorizations granted     solaris.auth.assign/delegate profiles    profiles granted           solaris.profile.assign/delegateprivs       privileges granted         solaris.privilege.assign/delegatelimitpriv   the limit set of           solaris.privilege.assign/delegate            privileges for the             command processdefaultpriv  the inheritable set of    solaris.privilege.assign/delegate             privileges for the              command process

The value oflimitpriv that can be set by an authorized userfor a given command are limited to thelimitpriv privilges that aregranted to the user.

The value of thedefaultpriv that can be set by an authorizeduser for a given command are limited to thedefaultpriv privileges grantedto the user.

Thesolaris.auth.assign authorization allows the authorized user to grant any authorization toanother user. Thesolaris.auth.delegate allows the authorized user to grant only theuser's authorizations to another user. The same principle applies to profiles, privileges.

Skip Navigation Links
Exit Print View
	man pages section 4: File Formats Oracle Solaris 11 Information Library