Go to main content

Oracle® Advanced Support Gateway Security Guide

Exit Print View

Updated: September 2024
 
 

Solaris 11 Initial Setup User RBAC Profile

The user for the initial setup requires a profile built from the following configuration file:

set desc="ACS Service Profile"
add cmd=<Service EM Base>/agent_home/core/<version>/root.sh
set uid=0
end
add cmd=/opt/oracle.cellos/imageinfo
set uid=0
end
add cmd=/opt/oracle.cellos/compmon/exadata_mon_hw_asr.pl
set uid=0
end
add cmd=/opt/ipmitool/bin/ipmitool
set uid=0
end
add cmd=/opt/ipmitool/sbin/ipmitool
set uid=0
end
add cmd=/usr/bin/chmod
set uid=0
end
add cmd=/usr/bin/chown
set uid=0
end
add cmd=/usr/bin/chgrp
set uid=0
end
add cmd=/usr/bin/crontab
set uid=0
end
add cmd=/usr/bin/cp
set uid=0
end
add cmd=/usr/bin/ex
set uid=0
end
add cmd=/usr/bin/vim
set uid=0
end
add cmd=/usr/bin/grep
set uid=0
end
add cmd=/usr/bin/ls
set uid=0
end
add cmd=/usr/sbin/groupadd
set uid=0
end
add cmd=/usr/bin/mkdir
set uid=0
end
add cmd=/usr/bin/rmdir
set uid=0
end
add cmd=/usr/bin/passwd
set uid=0
end
add cmd=/usr/bin/profiles
set uid=0
end
add cmd=/usr/lib/fm/notify/asr-notify
set uid=0
end
add cmd=/usr/sbin/svcadm
set uid=0
end
add cmd=/usr/sbin/useradd
set uid=0
end
add cmd=/usr/sbin/usermod
set uid=0
end
add cmd=/opt/exalogic/usr/sbin/imageinfo
set uid=0
end
add cmd=/usr/bin/tfactl
set uid=0
end
add cmd=/usr/bin/ahfctl
set uid=0
end
add cmd=<Service EM Base>/agent_home/agent_<version>/root.sh
set uid=0
end
add cmd=/tmp/install_ahf_no_cfg.sh
set uid=0
end
add cmd=/tmp/install_ahf.sh
set uid=0
end

If Oracle Enterprise Manager (OEM) agents are installed on an Exalogic, an NFS mount is configured by Oracle, and the user must also have the following command added to the profile:

add cmd=/sbin/mount
set uid=0
end

To create the profile from the configuration file above, perform the following as root or as a user with permission to create new profiles:

profiles -p <Profile name> -f <configuration file>
usermod -P +<Profile name> <user>

This provides the required level of access to perform the creation of the user and group directories, as well as setting the permissions on the Oracle inventory.