Visit Our UNIX and Linux User Community


RBAC related question.....


 
Thread Tools Search this Thread
Operating Systems Solaris RBAC related question.....
# 8  
Old 07-20-2009
samar and jlliagre, thanks for your valuable time...

I understand the need for entries in /etc/security/prof_attr and /etc/security/exec_attr..but let me ask you .. suppose if i do that this way:
vi /etc/security/prof_attr
shut:::Shut down the system:

vi /etc/security/exec_attr
shut:suser:cmd:::/usr/sbin/shutdown:uid=0

(note that the profile is not being given auths=solaris.system.shutdown attribute)

roleadd -m -d /export/home/adminusr -P shut adminusr

usermod -R adminusr neil

It works perfect even without any authorization...then where will the need for the -A switch arise..?This is the question I am trying to get an answer for the whole 5 hours of yesterday.., that is the reason why I wanted to create a role and user with just entries in /etc/user_attr instead of /etc/security/prof_attr and /etc/security/exec_attr.
kindly help me out...!
# 9  
Old 07-20-2009
Quote:
Originally Posted by saagar
It works perfect even without any authorization...then where will the need for the -A switch arise..?
actually here u have authorization Smilie)) in solaris RBAC there are predefined authorizations. you cant modify it as u did with prof_attr and exec_attr .
in your situation "shutdown" authorization works:
solaris.system.shutdown:::Shutdown the System::help=SysShutdown.html

look at your /etc/security/auth_attr .. your role adminusr takes authorization from that file. (this file auth_attr not only for roles, it gives users also definite rights).

hope this map will let you gain some insight.
RBAC related question.....-rolejpg
# 10  
Old 07-20-2009
thanks samar,
but sorry to ask you again, if authorisation is predefined, why the need for -A switch in roleadd and why Bill Calkins had mentioned it explicitly? pls dont get irritated with my question..thanks.
# 11  
Old 07-21-2009
My understanding is these authorizations were really meant for the Secure Extensions and are now obsolete. They simply seem to be of no use in Solaris 10/Open Solaris. I have found no reference of them, outside their declaration in Open Solaris source code.
# 12  
Old 07-21-2009
jlliagre, thanks a lot for your reply. I will take your word and I am not going to dig more about authorization... Thanks a lot.

Previous Thread | Next Thread
Test Your Knowledge in Computers #53
Difficulty: Easy
Computer caches are typically built using EPROMS.
True or False?

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Question related to grep

We have huge file with control A as delimiter. Somehow one record is corrupted. This time i figured it out using ETL graph. If future , how to print only bad record. Example Correct record:... (2 Replies)
Discussion started by: srikanth38
2 Replies

2. Shell Programming and Scripting

awk related question

awk -F ";" 'FNR==NR{a=$1;next} ($2 in a)' server.list datafile | while read line do echo ${line} done when i run the above, i get this: 1 SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... instead of: SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... can... (4 Replies)
Discussion started by: SkySmart
4 Replies

3. UNIX for Dummies Questions & Answers

Question related to 'ps'

If I run a script called 'abc.sh' and then execute the following : ps -ef | grep 'abc.sh' I always get two rows of output, one for the executing script, and the other for the grep command that I have triggered after the pipe. Questions: Why does the second row turn up in the results. My... (10 Replies)
Discussion started by: jawsnnn
10 Replies

4. Shell Programming and Scripting

awk related question

awk "/^<Mar 31, 2012 : /,0" /app/blah.log can someone please help me figure out why the above command isn't pulling anything out from the log? basically, i want it to pull out all records, from the very first line that starts with the date "Mar 31, 2012" and that also has a time immediately... (4 Replies)
Discussion started by: SkySmart
4 Replies

5. Shell Programming and Scripting

having df command related question

Hi All, When i have run the below command its showing 90% which is critical for production. for this i need the answer of some below question please help me for that. 1) i want to delete some unwanted files. how can i know the unwanted files ?Is it there any way of knowing this?? 2)and... (2 Replies)
Discussion started by: aish11
2 Replies

6. HP-UX

RBAC question

hi every one i tried rbac and i made 1- role called GizaRoot 2- group called gizagroup 3- added privlage autherization called "m.k" /usr/sbin/useradd:dflt:(m.k,*):0/0//:dflt:dflt:dflt: i assigned the role to group and add user to that group then su to user and tried to use the command ... (0 Replies)
Discussion started by: maxim42
0 Replies

7. AIX

RBAC in 5.3 Question

I would like to use the Role Based access control to granulize some of the administration of AIX systems in our organization. Across the company we will be using aix 5.3. One of these roles will only have the access to make, change and delete users, something similar to ManageAllUsers. The thing... (1 Reply)
Discussion started by: dgaixsysadm
1 Replies

8. UNIX for Advanced & Expert Users

One Question related to alias

Hello, I have created following alias in csh lab 'rlogin -l user23 complab23' but problem is complab23 does not allow automatic login by checking .rhosts file. So after typing lab on command line I have to type complicate password and if wrong password is typed thrice then account gets... (4 Replies)
Discussion started by: neerajrathi2
4 Replies

9. Programming

signals related question

Hi all, Just a little question relative to signals. I know that if an application is in the sleep state, When a signal is catched, it will be processed by the handler. But what happens if it's processing something? Does the processing stops?? The following code should illustrate this case ... (2 Replies)
Discussion started by: ninjanesto
2 Replies

10. UNIX for Dummies Questions & Answers

A Question related to the net

well, I was suggested to remove the contents of the cache as i get out of the browser netscape from the .netscape folder. is that really necessary? if so what are the rest to be done? can anybody please tell me?:rolleyes: (8 Replies)
Discussion started by: sskb
8 Replies

Featured Tech Videos