| Skip Navigation Links | |
| Exit Print View | |
 | man pages section 3: Basic Library Functions Oracle Solaris 11 Information Library |
| Skip Navigation Links | |
| Exit Print View | |
| man pages section 3: Basic Library Functions Oracle Solaris 11 Information Library |
enable_extended_FILE_stdio(3C)
posix_spawnattr_getschedparam(3C)
posix_spawnattr_getschedpolicy(3C)
posix_spawnattr_getsigdefault(3C)
posix_spawnattr_getsigignore_np(3C)
posix_spawnattr_getsigmask(3C)
posix_spawnattr_setschedparam(3C)
posix_spawnattr_setschedpolicy(3C)
posix_spawnattr_setsigdefault(3C)
posix_spawnattr_setsigignore_np(3C)
posix_spawnattr_setsigmask(3C)
posix_spawn_file_actions_addclose(3C)
posix_spawn_file_actions_addclosefrom_np(3C)
posix_spawn_file_actions_adddup2(3C)
posix_spawn_file_actions_addopen(3C)
posix_spawn_file_actions_destroy(3C)
posix_spawn_file_actions_init(3C)
pthread_attr_getdetachstate(3C)
pthread_attr_getinheritsched(3C)
pthread_attr_getschedparam(3C)
pthread_attr_getschedpolicy(3C)
pthread_attr_setdetachstate(3C)
pthread_attr_setinheritsched(3C)
pthread_attr_setschedparam(3C)
pthread_attr_setschedpolicy(3C)
pthread_barrierattr_destroy(3C)
pthread_barrierattr_getpshared(3C)
pthread_barrierattr_setpshared(3C)
pthread_condattr_getpshared(3C)
pthread_condattr_setpshared(3C)
pthread_cond_reltimedwait_np(3C)
pthread_key_create_once_np(3C)
pthread_mutexattr_getprioceiling(3C)
pthread_mutexattr_getprotocol(3C)
pthread_mutexattr_getpshared(3C)
pthread_mutexattr_getrobust(3C)
pthread_mutexattr_setprioceiling(3C)
pthread_mutexattr_setprotocol(3C)
pthread_mutexattr_setpshared(3C)
pthread_mutexattr_setrobust(3C)
pthread_mutex_getprioceiling(3C)
pthread_mutex_reltimedlock_np(3C)
pthread_mutex_setprioceiling(3C)
pthread_rwlockattr_destroy(3C)
pthread_rwlockattr_getpshared(3C)
pthread_rwlockattr_setpshared(3C)
pthread_rwlock_reltimedrdlock_np(3C)
pthread_rwlock_reltimedwrlock_np(3C)
pthread_rwlock_timedrdlock(3C)
pthread_rwlock_timedwrlock(3C)
rctlblk_get_enforced_value(3C)
- get authorization entry
authattr_t *getauthattr(void);
authattr_t *getauthnam(const char *name);
voidfree_authattr(authattr_t *auth);
voidsetauthattr(void);
voidendauthattr(void);
intchkauthattr(const char *authname,const char *username);
Thegetauthattr() andgetauthnam() functions each return anauth_attr(4) entry. Entries cancome from any of the sources specified in thensswitch.conf(4) file.
Thegetauthattr() function enumeratesauth_attr entries. Thegetauthnam() function searches for anauth_attr entry with a given authorization namename. Successive calls to thesefunctions return either successiveauth_attr entries orNULL.
Th internal representation of anauth_attr entry is anauthattr_t structure definedin <auth_attr.h> with the following members:
char *name; /* name of the authorization */char *res1; /* reserved for future use */char *res2; /* reserved for future use */char *short_desc; /* short description */char *long_desc; /* long description */kva_t *attr; /* array of key-value pair attributes */
Thesetauthattr() function “rewinds” to the beginning of the enumeration ofauth_attrentries. Calls togetauthnam() can leave the enumeration in an indeterminatestate. Therefore,setauthattr() should be called before the first call togetauthattr().
Theendauthattr() function may be called to indicate thatauth_attr processing iscomplete; the system may then close any openauth_attr file, deallocate storage,and so forth.
Thechkauthattr() function verifies whether or not a user has a givenauthorization. It first reads theuser_attr(4) database and returns 1 if it findsa match for the given authorization. If it does not find amatch inuser_attr,chkauthattr() reads theprof_attr(4) database using the listof profiles assigned to the user and checks if any of theprofiles assigned to the user has the given authorization. Whenchkauthattr() findsa profile called “Stop”, further profiles are ignored, the authorizations and profiles mentionedin/etc/security/policy.conf are ignored and it returns 0. If it does notfind a match in the user's profiles,chkauthattr() reads theAUTHS_GRANTED keyin the/etc/security/policy.conf file and returns 1 if it finds a match for thegiven authorization. Ifchkauthattr() does not find a match and the usernameis the name of the “console user”, defined as the owner of/dev/console, it first reads theCONSOLE_USER key in/etc/security/policy.conf and returns 1 ifthe given authorization is in any of the profiles specified in theCONSOLE_USER keyword, then reads thePROFS_GRANTED key in/etc/security/policy.conf and returns 1if the given authorization is in any profiles specified with thePROFS_GRANTED keyword.Thechkauthattr() function returns 0 if it does not find a matchin any of the three sources or if the user does notexist.
Authorization names consist of a hierarchical set of dot (.)-separated words, calledthe predicate, and an optional object qualifier preceded by a slash character(/). Authorizations listed inuser_attr andprof_attr may contain an asterisk (*)following the final dot in the predicate to indicate a wildcard. The reservedwordgrant, used for delegating authorizations, is not matched by *.
A user is considered to have been assigned an authorization if allof the following are true:
The authorization name matches exactly any authorization assigned in theuser_attr orprof_attr databases (authorization names are case-sensitive).
The predicate ofauthname matches the predicate of an authorization completely, or the predicate does not end ingrant and matches up to the * if present.
The authorization name suffix is not the key wordgrant and the authorization name matches any authorization up to the asterisk (*) character assigned in theuser_attr orprof_attr databases.
If the authorization includes an object qualifier, thenauthname must include the same object qualifier.
The examples in the following table illustrate the conditions under which auser is assigned an authorization.
|
Thefree_authattr() function releases memory allocated by thegetauthnam() andgetauthattr()functions.
Thegetauthattr() function returns a pointer to anauthattr_t if itsuccessfully enumerates an entry; otherwise it returnsNULL, indicating the end ofthe enumeration.
Thegetauthnam() function returns a pointer to anauthattr_t if itsuccessfully locates the requested entry; otherwise it returnsNULL.
Thechkauthattr() function returns 1 if the user is authorized and 0if the user does not exist or is not authorized.
Thegetauthattr() andgetauthnam() functions both allocate memory for the pointers theyreturn. This memory should be deallocated with thefree_authattr() call.
Individual attributes in theattr structure can be referred to by callingthekva_match(3C) function.
Because the list of legal keys is likely to expand, code must be written to ignore unknown key-value pairs without error.
configuration file lookup information for the name server switch
extended user attributes
authorization attributes
policy definitions
profile information
Seeattributes(5) for descriptions of the following attributes:
|
getexecattr(3C),getprofattr(3C),getuserattr(3C),auth_attr(4),nsswitch.conf(4),prof_attr(4),user_attr(4),attributes(5),rbac(5)
Copyright © 2011, Oracle and/or its affiliates. All rights reserved.Legal Notices |   |