|Skip Navigation Links|
|Exit Print View|
|System Administration Guide: Security Services Oracle Solaris 11 Express 11/10|
This section describes some typical rights profiles. Rights profiles can include authorizations, commands with security attributes, and supplementary rights profiles. The rights profiles are listed from most to least powerful. For suggestions on how to distribute rights profiles to roles at your site, see How to Plan Your RBAC Implementation.
Stop rights profile – Is a special rights profile that stops the evaluation of further profiles. The Stop rights profile prevents the evaluation of the AUTHS_GRANTED, PROFS_GRANTED, and CONSOLE_USER variables in the policy.conf file.
Each rights profile has an associated help file. The help files are in HTML and are customizable. The files reside in the /usr/lib/help/profiles/locale/C directory.
The System Administrator rights profile is intended for the System Administrator role. This profile is a set of discrete, supplementary administrative rights profiles that do not deal with security. The commands with security attributes from one of the supplementary rights profiles are shown.
Note that the All rights profile is assigned at the end of the list of supplementary rights profiles.
Table 10-1 Contents of System Administrator Rights Profile
The Operator rights profile is a less powerful profile that provides the ability to do backups and printer maintenance. The ability to restore files has more security consequences. Therefore, in this profile, the default is to not include the ability to restore files.
Table 10-2 Contents of Operator Rights Profile
Table 10-3 Contents of Printer Management Rights Profile
By default, the Basic Solaris User rights profile is assigned automatically to all users through the policy.conf file. This profile provides basic authorizations that are useful in normal operations. Note that the convenience that is offered by the Basic Solaris User rights profile must be balanced against site security requirements. Sites that need stricter security might prefer to remove this profile from the policy.conf file.
Table 10-4 Contents of Basic Solaris User Rights Profile
The Console User rights profile is intended for the console user, that is, the person who is seated in front of the system. This profile is delivered with a convenient set of authorizations for the console user. You can modify the Console User rights profile to satisfy your site security requirements. To modify a rights profile, see How to Create or Change a Rights Profile.
Table 10-5 Contents of Console User Rights Profile
The All rights profile uses the wildcard to include all commands. This profile provides a role with access to all commands that are not explicitly assigned in other rights profiles. Without the All rights profile or other rights profiles that use wildcards, a role has access to explicitly assigned commands only. Such a limited a set of commands is not very practical. No authorizations are included in this profile.
If used, the All rights profile, imust be the final rights profile that is assigned. This last position ensures that explicit security attribute assignments in other rights profiles are applied.
Table 10-6 Contents of All Rights Profile
The Stop rights profile stops the processing of authorizations and rights profiles. Only authorizations and rights profiles that precede the Stop profile are evaluated. Therefore, no information from the the policy.conf file is processed. The Stop profile enables you to provide role users with a restricted profile shell.
Note - The Stop profile affects privilege assignment indirectly. Rights profiles that are listed after the Stop profile are not evaluated. Therefore, the commands with privileges in those profiles are not in effect. To use this profile, see How to Restrict an Administrator to Explicitly Assigned Rights.
The help file for this profile is RtReservedProfile.html.
The commands in rights profiles are interpreted in order. The first occurrence of a command is the only version of the command that is used for that role or user. Different rights profiles can include the same command. Therefore, the order of rights profiles in a list of profiles is important. The rights profile with the most capabilities must be listed first.
Rights profiles are listed in the prof_attr file. In the prof_attr file, the rights profile with the most capabilities must be the first in a list of supplementary profiles. This placement ensures that a command with security attributes is listed before that same command without security attributes.
The contents of a rights profile is divided between two files. The prof_attr file contains the name of every rights profile that is defined on the system. The file also includes the authorizations, the privileges, and the supplementary rights profiles for each profile. The exec_attr file contains the names of rights profiles and their commands with security attributes.