'\" te .\" Copyright (c) 2008, 2013, Oracle and/or its affiliates. All rights reserved. .TH prof_attr 4 "10 Apr 2012" "SunOS 5.11" "File Formats" .SH NAME prof_attr \- profile description database .SH SYNOPSIS .LP .nf \fB/etc/security/prof_attr\fR .fi .SH DESCRIPTION .sp .LP \fB/etc/security/prof_attr\fR is a local source for execution profile names, descriptions, and other attributes of execution profiles. The \fBprof_attr\fR file can be used with other profile sources, including the \fBprof_attr\fR \fBNIS\fR map. Programs use the \fBgetprofattr\fR(3C) routines to gain access to this information. .sp .LP The search order for multiple \fBprof_attr\fR sources is specified in the \fB/etc/nsswitch.conf\fR file, as described in the \fBnsswitch.conf\fR(4) man page. .sp .LP An execution profile is a mechanism used to bundle together the commands and authorizations needed to perform a specific function. An execution profile can also contain other execution profiles. Each entry in the \fBprof_attr\fR database consists of one line of text containing five fields separated by colons (\fB:\fR). Line continuations using the backslash (\fB\e\fR) character are permitted. The format of each entry is: .sp .LP \fIprofname\fR:\fIres1\fR:\fIres2\fR:\fIdesc\fR:\fIattr\fR .sp .ne 2 .mk .na \fB\fIprofname\fR\fR .ad .RS 12n .rt The name of the profile. Profile names are case-sensitive. .RE .sp .ne 2 .mk .na \fB\fIres1\fR\fR .ad .RS 12n .rt The characters \fBRO\fR in this field indicate it is read only and not modifiable by the tools that update this database. .RE .sp .ne 2 .mk .na \fB\fIres2\fR\fR .ad .RS 12n .rt Reserved for future use. .RE .sp .ne 2 .mk .na \fB\fIdesc\fR\fR .ad .RS 12n .rt A long description. This field should explain the purpose of the profile, including what type of user would be interested in using it. The long description should be suitable for displaying in the help text of an application. .RE .sp .ne 2 .mk .na \fB\fIattr\fR\fR .ad .RS 12n .rt An optional list of semicolon-separated (\fB;\fR) key-value pairs that describe the security attributes to apply to the object upon execution. Zero or more keys can be specified. The following keys are currently interpreted by the system: .sp \fBhelp\fR is assigned the name of a file ending in \fB\&.htm\fR or \fB\&.html\fR. .sp \fBaudit_flags\fR specifies per-user audit preselection flags as a colon-separated list of \fBalways-audit-flags\fR and \fBnever-audit-flags\fR values; for example, \fBaudit_flags\fR=\fBalways-audit-flags\fR:\fBnever-audit-flags\fR. See \fBaudit_flags\fR(5). .sp \fBauths\fR specifies a comma-separated list of authorization names chosen from those names defined in the \fBauth_attr\fR(4) database. Authorization names can be specified using the asterisk (\fB*\fR) character as a wildcard. For example, \fBsolaris.printer.*\fR would mean all of Oracle Solaris's authorizations for printing. .sp \fBpam_policy\fR specifies the PAM policy to apply to a user. \fBpam_policy\fR must be either an absolute pathname to a \fBpam.conf\fR(4)-formatted file or the name of a \fBpam.conf\fR-formatted file located in \fB/etc/security/pam_policy\fR. See \fBpam_user_policy\fR(5) for more information .sp \fBaccess_times\fR specifies the days and times that the corresponding set of applications and services can be accessed. When checking the rules for a specific service the evaluation begins with the \fBaccess_times\fR in the user's \fBuser_attr\fR(4) database, and then follows the \fBaccess_times\fR in the user's profiles and sub-profiles until a matching service name or a wildcard entry is found. If no rules are found for the service, the user is exempt from time restrictions for that service. See \fBuser_attr\fR(4) for a description of the syntax for this property. .sp \fBprofiles\fR specifies a comma-separated list of profile names chosen from those names defined in the \fBprof_attr\fR database. .sp \fBprivs\fR specifies a comma-separated list of privileges names chosen from those names defined in the \fBpriv_names\fR(4) database. These privileges can then be used for executing commands with \fBpfexec\fR(1). .sp \fBaudit_flags\fR, \fBpam_policy\fR, \fBdefaultpriv\fR, and \fBlimitpriv\fR have the same semantics as in \fBuser_attr\fR(4). If they are not specified in the \fBuser_attr\fR database, the assigned profiles are searched until a match is found. .RE .SH EXAMPLES .LP \fBExample 1 \fRAllowing Execution of All Commands .sp .LP The following entry allows the user to execute all commands: .sp .in +2 .nf All:::Use this profile to give a :help=All.html .fi .in -2 .sp .LP \fBExample 2 \fRConsulting the Local \fBprof_attr\fR File First .sp .LP With the following \fBnsswitch.conf\fR entry, the local \fBprof_attr\fR file is consulted before the \fBNIS\fR map: .sp .in +2 .nf prof_attr: files nis .fi .in -2 .sp .SH FILES .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.conf\fR\fR .ad .sp .6 .RS 4n Configuration file for the name service switch .RE .sp .ne 2 .mk .na \fB\fB/etc/security/prof_attr\fR\fR .ad .sp .6 .RS 4n Locally added entries. Make sure that the shipped header remains intact. .RE .sp .ne 2 .mk .na \fB\fB/etc/security/prof_attr.d/*\fR\fR .ad .sp .6 .RS 4n Entries added by package installation. .RE .SH NOTES .sp .LP The root user is usually defined in local databases because root needs to be able to log in and do system maintenance in single-user mode and at other times when the network name service databases are not available. So that the profile definitions for root can be located at such times, root's profiles should be defined in the local \fBprof_attr\fR file, and the order shown in the example \fBnsswitch.conf\fR(4) file entry under EXAMPLES is highly recommended. .sp .LP Because the list of legal keys is likely to expand, any code that parses this database must be written to ignore unknown key-value pairs without error. When any new keywords are created, the names should be prefixed with a unique string, such as the company's stock symbol, to avoid potential naming conflicts. .sp .LP Each application has its own requirements for whether the \fBhelp\fR value must be a relative pathname ending with a filename or the name of a file. The only known requirement is for the name of a file. .sp .LP The following characters are used in describing the database format and must be escaped with a backslash if used as data: colon (\fB:\fR), semicolon (\fB;\fR), equals (\fB=\fR), and backslash (\fB\e\fR). .sp .LP The following authorizations are required to set various fields: .sp .in +2 .nf prof namename of profile solaris.profile.manage desc description of profile solaris.profile.manage help html help file name solaris.profile.manage of profile audit_flags audit preselection flags solaris.audit.assign auths authorizations granted solaris.auth.assign/delegate pam_policy PAM policy applied solaris.account.setpolicy access_times PAM time policy solaris.account.setpolicy profiles profiles granted solaris.profile.assign/delegate privs privileges granted solaris.privilege.assign/delegate limitpriv the limit set of solaris.privilege.assign/delegate privileges for the command process defaultpriv the inheritable set of solaris.privilege.assign/delegate privileges for the command process .fi .in -2 .sp .sp .LP The value of \fBlimitpriv\fR that can be set by an authorized user for a given command is limited to the \fBlimitpriv\fR privileges that are granted to the user. .sp .LP The value of the \fBdefaultpriv\fR that can be set by an authorized user for a given command is limited to the \fBdefaultpriv\fR privileges granted to the user. .sp .LP The \fBsolaris.auth.assign\fR authorization allows the authorized user to grant any authorization to another user. The \fBsolaris.auth.delegate\fR allows the authorized user to grant only the user's authorizations to another user. The same principle applies to profiles, privileges. .SH SEE ALSO .sp .LP \fBauths\fR(1), \fBpfexec\fR(1), \fBprofiles\fR(1), \fBgetauthattr\fR(3C), \fBgetprofattr\fR(3C), \fBgetuserattr\fR(3C), \fBauth_attr\fR(4), \fBexec_attr\fR(4), \fBpriv_names\fR(4), \fBuser_attr\fR(4), \fBaudit_flags\fR(5), \fBpam_user_policy\fR(5)