NAME | SYNOPSIS | DESCRIPTION | FILES | ATTRIBUTES | NOTES | SEE ALSO
#include <tsol/auth.h>
Every defined authorization has a manifest constant for use in programs, a name for use in user interfaces, and a description displayed by certain administrative tools. A set of authorizations is assigned to an execution profile, and the execution profile is assigned to a user or role. The user or role to which the execution profile is assigned has the authority to perform the tasks allowed by the authorizations in the execution profile. Authorizations are interpreted by utility and desktop tools. The manifest constant, name, and description for each authorization defined on this system follow.
TSOL_AUTH_ENABLE_LOGIN
enable logins
Allows a user to enable logins on a machine that was just booted. Until logins are enabled there is no interactive use of the machine's resources.
TSOL_AUTH_REMOTE_LOGIN
remote login
Allows a user to remotely login, using programs such as TELNET, or FTP, in a way that requires entering identification and authentication information. Such a login is different from extending an existing login from one machine to another without re-authentication because the trusted path is not guaranteed for these methods.
TSOL_AUTH_TERMINAL_LOGIN
terminal login
Allows a user to login via a serial port. Such a login is different from extending an existing login from one machine to another without re-authentication because there is no trusted path presented for entering either the identification or authentication information.
TSOL_AUTH_FILE_AUDIT
set/get file audit flags
Allows a user to specify or view the auditing preselection information or public object flag to be associated with access to a file or directory. The auditing preselection information may override the preselection information associated with a user's access to a file or directory. The public object flag may override the successful read/search access preselection information associated with a user's access to a file or directory.
TSOL_AUTH_FILE_DOWNGRADE_SL
downgrade file sensitivity label
Allows a user to specify the Sensitivity Label to set on a file that does not dominate the file's existing Sensitivity Label.
TSOL_AUTH_FILE_UPGRADE_SL
upgrade file sensitivity label
Allows a user to specify the Sensitivity Label to set on a file that dominates the file's existing Sensitivity Label.
TSOL_AUTH_FILE_OWNER
act as file owner
Allows a user to act as a file's owner. This includes the ability to change the permission bits and ACL, to downgrade the Sensitivity Label, and set privileges (if further authorized by set file privileges) of files not owned. Also included is the ability to read and search directories, copy, move, and delete files not owned.
TSOL_AUTH_FILE_CHOWN
change file owner
Allows a user to change the ownership and group of a file.
TSOL_AUTH_FILE_SETPRIV
set file privileges
Allows a user to specify the allowed and forced privileges to be associated with a the execution of a program file.
TSOL_AUTH_ALLOCATE
allocate device
Allows a user to allocate a device and specify the CMW label to associate with information imported from it, or exported to it.
TSOL_AUTH_CONFIG_DEVICE
configure device attributes
Allows an administrator to configure a device. Device configuration includes such things as setting the device name, type, label range, allocatable status, and allocation authorization list.
TSOL_AUTH_REVOKE_DEVICE
revoke or reclaim device
Allows an administrator to deallocate a currently allocated device or reset the allocate error state to make a device allocatable again.
TSOL_AUTH_WIN_DOWNGRADE_SL
paste to a downgraded window
Allows a user to paste selected information to a window whose Sensitivity Label does not dominate the selected information's Sensitivity Label.
TSOL_AUTH_WIN_UPGRADE_SL
paste to an upgraded window
Allows a user to paste selected information to a window whose Sensitivity Label dominates the selected information's Sensitivity Label.
TSOL_AUTH_SYS_ACCRED_SET
use all defined labels
Allows a user to use all the available labels on the system rather than to be restricted to just the labels in the label encodings defined user accreditation range. Using a label implies the ability to specify that label for any of the label building interfaces which include those to re-label files and create workspaces.
TSOL_AUTH_BYPASS_FILE_VIEW
bypass file view
Allows a user to drag and drop a file without viewing that file's contents.
TSOL_AUTH_SHUTDOWN
shut down the system
Allows a user to shut down the system via the Trusted Path menu. When the system is a CDE X Terminal, the CDE X Terminal is shut down, not the server. Unless the ``abort_enable'' system variable (see /etc/system) is set to 0, this authorization can be bypassed by entering the keyboard abort sequence, gaining entry to the PROM, and rebooting from the PROM.
TSOL_AUTH_USER_INDENT
set user identity
Allows an administrator to set the security information related to the user's identity. The user name, primary group, secondary groups, comment, and login shell may all be set via the User Manager. This authorization is needed to add, copy, or delete a user.
TSOL_AUTH_USER_PASSWORD
set user password
Allows an administrator to set password information pertaining to a user. The password, type of password, life time, expiration date, warning days, and the permission to set up the credentials table may all be set via the User Manager.
TSOL_AUTH_USER_SELF
permit self-modification
Allows an administrator to modify his or her own user attributes.
TSOL_AUTH_USER_LABELS
set user labels
Allows an administrator to set various label-related pieces of information associated with a particular user. A user's minimum login label, clearance, label view, and label translation attributes may be set via the User Manager.
TSOL_AUTH_USER_AUDIT
set user audit flags
Allows an administrator to set the per user audit flags.
TSOL_AUTH_USER_PROFILES
set user profiles
Allows an administrator to assign profiles to a user.
TSOL_AUTH_USER_IDLE
set idle time
Allows an administrator to set the idle time and determine which action to take when a workstation has been idle for too long. The idle time and idle command can be set via the User Manager.
TSOL_AUTH_USER_ROLES
set roles list
Allows an administrator to select which roles a user may assume. When a user assumes a role he or she may use all commands and actions granted to that role.
TSOL_AUTH_USER_HOME
set home directory attributes
Allows an administrator to determine such things as location, permissions, and initial contents of a user's home directory.
TSOL_AUTH_PRINT_ADMIN
administer printing
Allows a user to perform Trusted Printing System administration. Allows a user to start and stop printing daemons, list and cancel other users' print jobs, etc.
TSOL_AUTH_PRINT_CANCEL
cancel any print job
Allows user to cancel a print request queued by any user.
TSOL_AUTH_PRINT_LIST
list all print jobs
Allows a user to get a list of queued print jobs for all users.
TSOL_AUTH_PRINT_MAC_OVERRIDE
bypass print system mac check
Allows a user to cancel or list print jobs at any sensitivity label.
TSOL_AUTH_PRINT_NOBANNER
print without banners
Allows a user to submit a print request to the Trusted Printing System that specifies (by means of the 'lp -o nobanner' option) that the print job's banner and trailer pages should be suppressed.
TSOL_AUTH_PRINT_POSTSCRIPT
print a PostScript file
Allows a user to print a PostScript file with the Trusted Printing System.
TSOL_AUTH_PRINT_UNLABELED
print without labels
Allows a user to submit a print request to the Trusted Printing System that specifies (by means of the 'lp -o nolabels' option) that the body pages of the print job should have the top and bottom labels suppressed.
TSOL_AUTH_DB_ALIASES
modify aliases
Allows a user to edit the aliases databases via the Database Manager.
TSOL_AUTH_DB_AUTO_HOME
modify auto_home
Allows a user to edit the auto_home databases via the Database Manager.
TSOL_AUTH_DB_BOOTPARAMS
modify bootparams
Allows a user to edit the bootparams databases via the Database Manager.
TSOL_AUTH_DB_ETHERS
modify ethers
Allows a user to edit the ethers databases via the Database Manager.
TSOL_AUTH_DB_HOSTS
modify hosts
Allows a user to edit the hosts databases via the Database Manager.
TSOL_AUTH_DB_LOCALE
modify locale
Allows a user to edit the locale databases via the Database Manager.
TSOL_AUTH_DB_NETGROUP
modify netgroup
Allows a user to edit the netgroup databases via the Database Manager.
TSOL_AUTH_DB_NETMASKS
modify netmasks
Allows a user to edit the netmasks databases via the Database Manager.
TSOL_AUTH_DB_NETWORKS
modify networks
Allows a user to edit the networks databases via the Database Manager.
TSOL_AUTH_DB_PASSWD
modify password
Allows a user to edit the password databases via the Database Manager.
TSOL_AUTH_DB_PROTOCOLS
modify protocols
Allows a user to edit the protocols databases via the Database Manager.
TSOL_AUTH_DB_RPC
modify rpc
Allows a user to edit the rpc databases via the Database Manager.
TSOL_AUTH_DB_SERVICES
modify services
Allows a user to edit the services databases via the Database Manager.
TSOL_AUTH_DB_TIMEZONE
modify timezone
Allows a user to edit the timezone databases via the Database Manager.
TSOL_AUTH_DB_TNIDB
modify tnidb
Allows a user to edit the tnidb databases via the Database Manager.
TSOL_AUTH_DB_TNRHDB
modify tnrhdb
Allows a user to edit the tnrhdb databases via the Database Manager.
TSOL_AUTH_DB_TNRHTP
modify tnrhtp
Allows a user to edit the tnrhtp databases via the Database Manager.
TSOL_AUTH_CRON_ADMIN
modify cron admin
Allows a user to modify and list crontab files of role users and users named in /etc/cron.d/cron.admin.
TSOL_AUTH_CRON_USER
modify cron users
Allows a user to modify and list crontab files of non-administrative users.
TSOL_AUTH_AT_ADMIN
modify at admin
Allows a user to remove and list at jobs of role users and users named in /etc/cron.d/at.admin.
TSOL_AUTH_AT_USER
modify at users
Allows a user to remove and list all jobs of non-administrative users.
Authorizations descriptions
Manifest constant and ID value definitions
See attributes(5) for descriptions of the following attributes:
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
|---|---|
| Availability | SUNWtsu |
Information labels (ILs) are not supported in Trusted Solaris 7 and later releases. Trusted Solaris software interprets any ILs on communications and files from systems running earlier releases as ADMIN_LOW.
Objects still have CMW labels, and CMW labels still include the IL component: IL[SL]; however, the IL component is fixed at ADMIN_LOW.
As a result, Trusted Solaris 7 has the following characteristics:
ILs do not display in window labels; SLs (Sensitivity Labels) display alone within brackets.
ILs do not float.
Setting an IL on an object has no effect.
Getting an object's IL will always return ADMIN_LOW.
Although certain utilities, library functions, and system calls can manipulate IL strings, the resulting ILs are always ADMIN_LOW, and cannot be set on any objects.
Options related to information labels in the label_encodings(4) file can be ignored:
Markings Name= Marks; Float Process Information Label;
Intro(3), auth_to_str(3), chkauth(3), auth_name(4)
Trusted Solaris administrator's document set, Trusted Solaris Developer's Guide
NAME | SYNOPSIS | DESCRIPTION | FILES | ATTRIBUTES | NOTES | SEE ALSO