rolemod(1M)                                               System Administration Commands                                               rolemod(1M)

NAME

       rolemod - modify a role's login information on the system

SYNOPSIS

       rolemod  [ -u uid [-o]] [-g group] [ -G group [ , group...]] [ -d dir [-m]] [-s shell] [-c comment] [-l new_name] [-f inactive] [-e expire]
       [-A authorization  [, authorization]] [-P profile  [, profile]] [-K key=value] role

DESCRIPTION

       The rolemod utility modifies a role's login information on the system. It changes the definition of  the  specified  login  and  makes  the
       appropriate login-related system file and file system changes.

       The system file entries created with this command have a limit of 512 characters per line. Specifying long arguments to several options may
       exceed this limit.

OPTIONS

       The following options are supported:

       -A authorization        One or more comma separated authorizations as deined in auth_attr(4).  Only role with grant rights  to  the  autho-
                               rization can assign it to an account. This replaces any existing authorization setting. If no authorization list is
                               specified, the existing setting is removed.

       -c comment              Specify a comment string. comment can be any text string. It is generally a short description of the login, and  is
                               currently used as the field for the user's full name. This information is stored in the user's  /etc/passwd entry.

       -d dir                  Specify  the  new home directory of the role. It defaults to  base_dir/login, where  base_dir is the base directory
                               for new login home directories, and  login is the new login.

       -e expire               Specify the expiration date for a role.  After this date, no role will be able to access  this  login.  The  expire
                               option  argument  is  a  date entered using one of the date formats included in the template file /etc/datemsk. See
                               getdate(3C).

                               For example, you may enter 10/6/90 or  October 6, 1990. A value of `` '' defeats the status of the expired date.

       -f inactive             Specify the maximum number of days allowed between uses of a login ID before that login  ID  is  declared  invalid.
                               Normal values are positive integers. A value of 0 defeats the status.

       -g group                Specify an existing group's integer ID or character-string name. It redefines the role's primary group membership.

       -G group                Specify  an existing group's integer "ID" "," or character string name. It redefines the role's supplementary group
                               membership. Duplicates between group with the  -g and  -G options are ignored. No more than NGROUPS_UMAX groups may
                               be specified as defined in  <param.h>.

       -K key=value            Replace  existing  or  add to a role's key=value pair attributes. Multiple -K options may be used to replace or add
                               multiple key=value pairs.  The generic -K option with the appropriate key may  be  used  instead  of  the  specific
                               implied  key  options  (-A and -P). See user_attr(4) for a list of valid key=value pairs. Keys may not be repeated.
                               Specifying a key= without a value removes an existing key=value pair. The "type" key may only be specified  without
                               a value or with the "normal" value for this option. Specifying the "type" key without a value leaves the account as
                               a normal user, with the "role" value changing from a role user to a normal user.

       -l new_logname          Specify the new login name for the role.  The new_logname argument is a string no more than eight bytes  consisting
                               of  characters from the set of alphabetic characters, numeric characters, period (.), underline (_), and hypen (-).
                               The first character should be alphabetic and the field should contain at least one lower case alphabetic character.
                               A warning message will be written if these restrictions are not met.
                                A  future  Solaris release may refuse to accept login fields that do not meet these requirements.  The new_logname
                               argument must contain at least one character and must not contain a colon (:) or NEWLINE (
).

       -m                      Move the role's home directory to the new directory specified with the  -d option. If the directory already exists,
                               it must have permissions read/write/execute by  group, where  group is the role's primary group.

       -o                      This option allows the specified UID to be duplicated (non-unique).

       -P profile              One  or  more  comma-separated execution profiles defined in auth_attr(4).  This replaces any existing profile set-
                               ting. If no profile list is specified, the existing setting is removed.

       -s shell                Specify the full pathname of the program that is used as the role's shell on login. The value of  shell must  be  a
                               valid executable file.

       -u uid                  Specify  a  new  UID  for  the  role.  It  must  be  a  non-negative decimal integer less than MAXUID as defined in
                               <param.h>. The UID associated with the role's home directory is not modified with this option; a role will not have
                               access to their home directory until the UID is manually reassigned using chown(1).

OPERANDS

       The following operands are supported:

       login    An existing login name to be modified.

EXIT STATUS

       In case of an error,  rolemod prints an error message and exits with one of the following values:

       2        The command syntax was invalid. A usage message for the  rolemod command is displayed.

       3        An invalid argument was provided to an option.

       4        The  uid given with the  -u option is already in use.

       5        The password files contain an error. pwconv(1M) can be used to correct possible errors. See passwd(4).

       6        The login to be modified does not exist, the group does not exist, or the login shell does not exist.

       8        The login to be modified is in use.

       9        The  new_logname is already in use.

       10       Cannot update the  /etc/group or /etc/user_attr file. Other update requests will be implemented.

       11       Insufficient space to move the home directory (-m option). Other update requests will be implemented.

       12       Unable to complete the move of the home directory to the new home directory.

FILES

       /etc/group              system file containing group definitions

       /etc/datemsk            system file of date formats

       /etc/passwd             system password file

       /etc/shadow             system file containing users' and roles' encrypted passwords and related information

       /etc/usr_attr           system file containing additional  user and role attributes

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE         |      ATTRIBUTE VALUE        |
       +-----------------------------+-----------------------------+
       |Availability                 |SUNWcsu                      |
       +-----------------------------+-----------------------------+
       |Interface Stability          |Evolving                     |
       +-----------------------------+-----------------------------+

SEE ALSO

       chown(1),  passwd(1),  users(1B),  groupadd(1M), groupdel(1M), groupmod(1M), logins(1M), pwconv(1M), roleadd(1M), roledel(1M), useradd(1M),
       userdel(1M), usermod(1M), getdate(3C), auth_attr(4), passwd(4), attributes(5)

SunOS 5.10                                                          1 Jul 2004                                                         rolemod(1M)