The security administrator assigns security attributes to users after the user accounts are created. If you have set up correct defaults, your next step is to assign security attributes only for users who need exceptions to the defaults.
When assigning security attributes to users, consider the following information:
The system administrator can assign passwords to user accounts during account creation. After this initial assignment, the security administrator or the user can change the password.
As in Oracle Solaris, users can be forced to change their passwords at regular intervals. The password aging options limit how long any intruder who is able to guess or steal a password could potentially access the system. Also, establishing a minimum length of time to elapse before changing a password prevents a user with a new password from reverting immediately to the old password. For details, see the passwd(1) man page.
A user is not required to have a role. A user can be assigned more than one role if doing so is consistent with your site's security policy.
As in the Oracle Solaris OS, assigning authorizations to a user adds those authorizations to existing authorizations. For scalability, add the authorizations to a rights profile, then assign the profile to the user.
As in the Oracle Solaris OS, the order of rights profiles is important. With the exception of authorizations, the profile mechanism uses the value of the first instance of an assigned security attribute. For more information, see Order of Search for Assigned Rights in Securing Users and Processes in Oracle Solaris 11.2 .
You can use the sorting order of profiles to your advantage. If you want a command to run with different security attributes from those attributes that are defined for the command in an existing profile, create a new profile with the preferred assignments for the command. Then, insert that new profile before the existing profile.
The default privilege set can be too liberal for many sites. To restrict the privilege set for any regular user on a system, change the policy.conf file setting. To change the privilege set for individual users, see How to Restrict a User's Set of Privileges.
Changing a user's label defaults creates an exception to the user defaults in the label_encodings file.
As in the Oracle Solaris OS, assigning audit classes to a user modifies the user's preselection mask. For more information about auditing, see Managing Auditing in Oracle Solaris 11.2 and Chapter 22, Trusted Extensions and Auditing.