Solaris

Oracle Solaris 10 9/10 s10s_u9wos_14a SPARC

Hi, just starting with RBAC. I have managed to create a test user with assigned roles:

Code:

Basic Actions
Basic Solaris User

I also did

Code:

roleadd -d /export/home/userrole -m userrole

but when I did

Code:

rolemod -P "Basic Actions" userrole
rolemod -P "Basic Solaris User" userrole

I'm not sure if its cumulative or not. one thing for sure is the test user cannot make a directory nor remove one, so I did this

Code:

rolemod -P "File System Management" userrole

and tested. still the user cannot create nor remove directories.

So if I'm going to create a basic role for a regular user, how to go about doing it?

---------- Post updated at 04:43 PM ---------- Previous update was at 04:17 PM ----------

correction:

the test user is able to create and delete directories. the home directory of the test users was under the ownership of root that is why. after changing the ownership of the home directory, test user able to create and delete directories.

still the question remains, how to assign multiple roles in /etc/user_attr file?

---------- Post updated at 04:59 PM ---------- Previous update was at 04:43 PM ----------

got it!.

Code:

rolemod [-u uid] [-o] [-g group] [-G group] [-d dir] [-m] [-s shell][-c comment] [-l new_name] [-f inactive] [-e expire] [-A Authorization][-P profile] <role account>

The usermod assigns a role to a user, the rolemod command creates and modifies roles. I would use existing roles to start with and assign them to a user. Basic security (groups, etc.) should be used for file access because software you buy and load expects this, e.g. databases, math software.

Try: Role-Based Access Control (Overview) - Oracle Solaris Administration: Security Services
RBAC is meant for creating profiles for users like system operators who have to be able to run backups, restore disks, fix printer problems, etc. It is great for that purpose. IMO, messing around with general users and RBAC causes problems that do not need to happen. If you need elevated security you need to be on a trusted version of the OS for starters.