prof_attr(4) File Formats prof_attr(4)
prof_attr - profile description database
/etc/security/prof_attr is a local source for execution profile names, descriptions, and
other attributes of execution profiles. The prof_attr file can be used with other profile
sources, including the prof_attr NIS map and NIS+ table. Programs use the getpro-
fattr(3SECDB) routines to gain access to this information.
The search order for multiple prof_attr sources is specified in the /etc/nsswitch.conf
file, as described in the nsswitch.conf(4) man page.
An execution profile is a mechanism used to bundle together the commands and authoriza-
tions needed to perform a specific function. An execution profile can also contain other
execution profiles. Each entry in the prof_attr database consists of one line of text con-
taining five fields separated by colons (:). Line continuations using the backslash (\)
character are permitted. The format of each entry is:
profname The name of the profile. Profile names are case-sensitive.
res1 Reserved for future use.
res2 Reserved for future use.
desc A long description. This field should explain the purpose of the profile,
including what type of user would be interested in using it. The long descrip-
tion should be suitable for displaying in the help text of an application.
attr An optional list of semicolon-separated (;) key-value pairs that describe the
security attributes to apply to the object upon execution. Zero or more keys
can be specified. There are four valid keys: help, profiles, auths, and privs.
help is assigned the name of a file ending in .htm or .html.
auths specifies a comma-separated list of authorization names chosen from
those names defined in the auth_attr(4) database. Authorization names can be
specified using the asterisk (*) character as a wildcard. For example,
solaris.printer.* would mean all of Sun's authorizations for printing.
profiles specifies a comma-separated list of profile names chosen from those
names defined in the prof_attr database.
privs specifies a comma-separated list of privileges names chosen from those
names defined in the priv_names(4) database. These privileges can then be used
for executing commands with pfexec(1).
Example 1 Allowing Execution of All Commands
The following entry allows the user to execute all commands:
All:::Use this profile to give a :help=All.html
Example 2 Consulting the Local prof_attr File First
With the following nsswitch.conf entry, the local prof_attr file is consulted before the
prof_attr: files nisplus
When deciding which authorization source to use (see DESCRIPTION), keep in mind that NIS+
provides stronger authentication than NIS.
The root user is usually defined in local databases because root needs to be able to log
in and do system maintenance in single-user mode and at other times when the network name
service databases are not available. So that the profile definitions for root can be
located at such times, root's profiles should be defined in the local prof_attr file, and
the order shown in the example nsswitch.conf(4) file entry under EXAMPLES is highly recom-
Because the list of legal keys is likely to expand, any code that parses this database
must be written to ignore unknown key-value pairs without error. When any new keywords are
created, the names should be prefixed with a unique string, such as the company's stock
symbol, to avoid potential naming conflicts.
Each application has its own requirements for whether the help value must be a relative
pathname ending with a filename or the name of a file. The only known requirement is for
the name of a file.
The following characters are used in describing the database format and must be escaped
with a backslash if used as data: colon (:), semicolon (;), equals (=), and backslash (\).
auths(1), pfexec(1), profiles(1), getauthattr(3SECDB), getprofattr(3SECDB), getuser-
attr(3SECDB), auth_attr(4), exec_attr(4), priv_names(4), user_attr(4)
SunOS 5.11 3 Apr 2008 prof_attr(4)