Visit Our UNIX and Linux User Community


RBAC question


 
Thread Tools Search this Thread
Operating Systems HP-UX RBAC question
# 1  
Old 11-11-2009
RBAC question

hi every one i tried rbac and i made
1- role called GizaRoot
2- group called gizagroup
3- added privlage autherization called "m.k"
/usr/sbin/useradd:dfltSmiliem.k,*):0/0//:dflt:dflt:dflt:

i assigned the role to group and add user to that group then su to user and tried to use the command
privrun useradd maxim it worked and every thing ok but i don't under stand why it uses the euid=0 and ruid=0 and i assigned only to group not user i tried to make the line like this /usr/sbin/useradd:dfltSmiliem.k,*)://107/0:dflt:dflt:dflt:
but it didn't work so i want one to explain to understand and thanks

Previous Thread | Next Thread
Test Your Knowledge in Computers #189
Difficulty: Easy
The boolean data type in Python is immutable.
True or False?

10 More Discussions You Might Find Interesting

1. AIX

RBAC and LDAP users (AD)

Hello everyone, I am having trouble with something, and I can't find the right answer online. On our company, we are using LDAP Authentication with Active Directory (Windows 2008 Servers) to have a centralized management of AIX 7.1 users. So far so good, but now, we want to implement RBAC on... (7 Replies)
Discussion started by: Janpol
7 Replies

2. Solaris

RBAC related question.....

I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files... This is the exact steps given by Bill calkins.. 1.roleadd -m -d /export/home/adminusr -c... (11 Replies)
Discussion started by: saagar
11 Replies

3. Solaris

rbac problem.

Hi all! On backup server with contab my script worked, but one command don't fine to be executed: bash-3.00$ scp itadmin@172.17.0.44:/export/backups/* /bckp1/opencms/bcp_`date +%Y%m%d`/ www-zone.cfg 100%... (0 Replies)
Discussion started by: sotich82
0 Replies

4. Linux

Sudo user vs RBAC

Hi all, What the difference between the sudo users & RBAC when the talk of effects after doing the above comes??? any differences between them ,kindly list ?? (1 Reply)
Discussion started by: saurabh84g
1 Replies

5. UNIX for Dummies Questions & Answers

Unix Rbac

Can anyone help me on "How to change Unix to support RBAC policy"? (4 Replies)
Discussion started by: JPoroo
4 Replies

6. AIX

RBAC in 5.3 Question

I would like to use the Role Based access control to granulize some of the administration of AIX systems in our organization. Across the company we will be using aix 5.3. One of these roles will only have the access to make, change and delete users, something similar to ManageAllUsers. The thing... (1 Reply)
Discussion started by: dgaixsysadm
1 Replies

7. Shell Programming and Scripting

Automating RBAC with IF/Then statement

what would be easier to automate a script if/then ? (0 Replies)
Discussion started by: deaconf19
0 Replies

8. Solaris

RBAC Help

do i have to create a new account to add a role? i want the sysadmin login i have 3 users on my systems sysadmin secman oc01 also 3 profiles SA (goes t0 sysadmin account) SSO (goes to secman account) LMICS (goes to oc01 account) the user accounts are located in /h/USERS/local the... (4 Replies)
Discussion started by: deaconf19
4 Replies

9. Solaris

Rbac

I am trying to let user asillitoe su to the godbrook role to execute commands. I have editted files as follows: user_attr: asillito::::type=normal;roles=godbrook godbrook::::type=role;profiles=Gadbrook,All prof_attr: Gadbrook:::Allow root commands to be used by godbrook: exec_attr:... (0 Replies)
Discussion started by: chrisdberry
0 Replies

10. UNIX for Advanced & Expert Users

RBAC logging

Hi gurus: I have not come accross any links on the internet that shows how to set up logging in RBAC and also is it possible to get the granularity and simplicity of sudo logging in RBAC. I have heard that RBAC logs are complicated to read and not as simple and granular as sudo logs. Your help... (0 Replies)
Discussion started by: geomonap
0 Replies
rbac(5)                                                 Standards, Environments, and Macros                                                rbac(5)

NAME
rbac - role-based access control DESCRIPTION
The addition of role-based access control (RBAC) to the Solaris operating environment gives developers the opportunity to deliver fine- grained security in new and modified applications. RBAC is an alternative to the all-or-nothing security model of traditional superuser- based systems. With RBAC, an administrator can assign privileged functions to specific user accounts (or special accounts called roles). There are two ways to give applications privileges: 1. Administrators can assign special attributes such as setUID to application binaries (executable files). 2. Administrators can assign special attributes such as setUID to applications using execution profiles. Special attribute assignment along with the theory behind RBAC is discussed in detail in "Role Based Access Control" chapter of the System Administration Guide: Security Services. This chapter describes what authorizations are and how to code for them. Authorizations An authorization is a unique string that represents a user's right to perform some operation or class of operations. Authorization defini- tions are stored in a database called auth_attr(4). For programming authorization checks, only the authorization name is significant. Some typical values in an auth_attr database are shown below. solaris.jobs.:::Cron and At Jobs::help=JobHeader.html solaris.jobs.grant:::Delegate Cron & At Administration::help=JobsGrant.html solaris.jobs.admin:::Manage All Jobs::help=AuthJobsAdmin.html solaris.jobs.user:::Cron & At User::help=JobsUser.html Authorization name strings ending with the grant suffix are special authorizations that give a user the ability to delegate authorizations with the same prefix and functional area to other users. Creating Authorization Checks To check authorizations, use the chkauthattr(3SECDB) library function, which verifies whether or not a user has a given authorization. The synopsis is: int chkauthattr(const char *authname, const char *username); The chkauthattr() function checks the policy.conf(4), user_attr(4), and prof_attr(4) databases in order for a match to the given authoriza- tion. If you are modifying existing code that tests for root UID, you should find the test in the code and replace it with the chkauthattr() function. A typical root UID check is shown in the first code segment below. An authorization check replacing it is shown in the second code segment; it uses the solaris.jobs.admin authorization and a variable called real_login representing the user. Example 1: Standard root check ruid = getuid(); if ((eflag || lflag || rflag) && argc == 1) { if ((pwp = getpwnam(*argv)) == NULL) crabort(INVALIDUSER); if (ruid != 0) { if (pwp->pw_uid != ruid) crabort(NOTROOT); else pp = getuser(ruid); } else pp = *argv++; } else { Example 2: Authorization check ruid = getuid(); if ((pwp = getpwuid(ruid)) == NULL) crabort(INVALIDUSER); strcpy(real_login, pwp->pw_name); if ((eflag || lflag || rflag) && argc == 1) { if ((pwp = getpwnam(*argv)) == NULL) crabort(INVALIDUSER); if (!chkauthattr("solaris.jobs.admin", real_login)) { if (pwp->pw_uid != ruid) crabort(NOTROOT); else pp = getuser(ruid); } else pp = *argv++; } else { For new applications, find an appropriate location for the test and use chkauthattr() as shown above. Typically the authorization check makes an access decision based on the identity of the calling user to determine if a privileged action (for example, a system call) should be taken on behalf of that user. Applications that perform a test to restrict who can perform their security-relevant functionality are generally setuid to root. Programs that were written prior to RBAC and that are only available to the root user may not have such checks. In most cases, the kernel requires an effective user ID of root to override policy enforcement. Therefore, authorization checking is most useful in programs that are setuid to root. For instance, if you want to write a program that allows authorized users to set the system date, the command must be run with an effective user ID of root. Typically, this means that the file modes for the file would be -rwsr-xr-x with root ownership. Use caution, though, when making programs setuid to root. For example, the effective UID should be set to the real UID as early as possible in the program's initialization function. The effective UID can then be set back to root after the authorization check is performed and before the system call is made. On return from the system call, the effective UID should be set back to the real UID again to adhere to the principle of least privilege. Another consideration is that LD_LIBRARY path is ignored for setuid programs (see SECURITY section in ld.so.1(1)) and that shell scripts must be modified to work properly when the effective and real UIDs are different. For example, the -p flag in Bourne shell is required to avoid resetting the effective UID back to the real UID. Using an effective UID of root instead of the real UID requires extra care when writing shell scripts. For example, many shell scripts check to see if the user is root before executing their functionality. With RBAC, these shell scripts may be running with the effective UID of root and with a real UID of a user or role. Thus, the shell script should check euid instead of uid. For example, WHO=`id | cut -f1 -d" "` if [ ! "$WHO" = "uid=0(root)" ] then echo "$PROG: ERROR: you must be super-user to run this script." exit 1 fi should be changed to WHO=`/usr/xpg4/bin/id -n -u` if [ ! "$WHO" = "root" ] then echo "$PROG: ERROR: you are not authorized to run this script." exit 1 fi Authorizations can be explicitly checked in shell scripts by checking the output of the auths(1) utility. For example, for auth in `auths | tr , " "` NOTFOUND do [ "$auth" = "solaris.date" ] && break # authorization found done if [ "$auth" != "solaris.date" ] then echo >&2 "$PROG: ERROR: you are not authorized to set the date" exit 1 fi SEE ALSO
ld.so.1(1), chkauthattr(3SECDB), auth_attr(4), policy.conf(4), prof_attr(4), user_attr(4) System Administration Guide: Security Services SunOS 5.10 15 Jul 2003 rbac(5)

Featured Tech Videos