Chapter 19 Role-Based Access Control

This chapter describes Role-Based Access Control, a new security feature in the Solaris 8 release.

• "Extended User Attributes Database (user_attr)"

• "Authorizations"

• "Execution Profiles"

• "Execution Attributes"

• "How to Assume Role-Based Access Control"

• "Tools for Managing Role-Based Access Control"

Overview of Role-Based Access Control

Role-based access control (RBAC) is an alternative to the all-or-nothing security model of traditional superuser-based systems. The problem with the traditional model is not just that superuser is so powerful but that other users are not powerful enough to fix their own problems. RBAC provides the ability to package superuser privileges for assignment to user accounts.

With RBAC, you can give users the ability to solve their own problems by assigning them packages of the appropriate privileges. Superuser's capabilities can be diminished by dividing those capabilities into several packages and assigning them separately to individuals sharing administrative responsibilities.

RBAC thus enables separation of powers, controlled delegation of privileged operations to other users, and a variable degree of access control.

RBAC includes these features:

• Authorization - A right that is used to grant access to a restricted function

• Execution profile (or simply profile) - A bundling mechanism for grouping authorizations and commands with special attributes; for example, user and group IDs

• Role - A special type of user account intended for performing a set of administrative tasks

RBAC relies on four databases to provide users access to privileged operations:

• user_attr (extended user attributes database) - Associates users and roles with authorizations and execution profiles

• auth_attr (authorization attributes database) - Defines authorizations and their attributes and identifies the associated help file

• prof_attr (execution profile attributes database) - Defines profiles, lists the profile's assigned authorizations, and identifies the associated help file

• exec_attr (profile execution attributes database) - Defines the privileged operations assigned to a profile

The following figure illustrates how RBAC works. Databases are shown in boxes while the arrows indicate relationships between databases. The entities assigned in the relationships appear next to the arrows.

You can assign authorizations (1) and profiles (2) to users in the user_attr database; this is direct assignment of privileged operations. You can also assign the user to a role (3), to give the user access to any privileged operations associated with that role. Profiles are defined in the prof_attr database and can include authorizations (4) defined in auth_attr and commands with attributes (5) defined for that profile in exec_attr.

Commands that are assigned to profiles are run in special shells called profile shells. The profile shells are pfsh, pfcsh, and pfksh, and they correspond to Bourne shell (sh), C shell (csh), and Korn shell (ksh) respectively.

Extended User Attributes Database (user_attr)

The /etc/user_attr database supplements the passwd and shadow databases. It contains extended user attributes such as authorizations and execution profiles. It also allows roles to be assigned to a user.

A role is a special type of user account that is intended for performing a set of administrative tasks. It is like a normal user account in most respects except that users can gain access to it only through the su command; it is not accessible for normal logins, for example, through the CDE login window. From a role account, a user can access commands with special attributes, typically root user ID, that are not available to users in normal accounts.

The fields in the user_attr database are separated by colons:

user:qualifier:res1:res2:attr

The fields are described in the following table.

A user_attr database with typical values is shown in the following example.

A typical role assignment is illustrated in the following user_attr database. In this example, the sysadmin role has been assigned to the user johndoe. When assuming the sysadmin role, johndoe has access to such profiles as Device Management, Filesystem Management, and the All profile.

Authorizations

An authorization is a user right that grants access to a restricted function. It is a unique string that identifies what is being authorized as well as who created the authorization.

Authorizations are checked by certain privileged programs to determine whether users can execute restricted functionality. For example, the solaris.jobs.admin authorization is required for one user to edit another user's crontab file.

All authorizations are stored in the auth_attr database. Authorizations may be assigned directly to users (or roles) in which case they are entered in the user_attr database. Authorizations can also be assigned to execution profiles which in turn are assigned to users.

The fields in the auth_attr database are separated by colons:

authname:res1:res2:short_desc:long_desc:attr

The fields are described in the following table.

An auth_attr database with some typical values is shown in the following example.

The relationship between the auth_attr and the user_attr databases is illustrated in the following example. The solaris.system.date authorization, which is defined in the auth_attr database, is assigned to the user johndoe in the user_attr database.

Execution Profiles

An execution profile is a bundling mechanism for grouping authorizations and commands with special attributes, and assigning them to users or roles. The special attributes include real and effective UIDs and GIDs. The most common attribute is setting the real or effective UID to root. The definitions of execution profiles are stored in the prof_attr database.

The fields in the prof_attr database are separated by colons:

profname:res1:res2:desc:attr

The fields are described in the following table.

A prof_attr database with some typical values is shown in the following example.

The relationship between the prof_attr and the user_attr databases is illustrated in the following example. The Device Management profile, which is defined in the prof_attr database, is assigned to the sysadmin role in the user_attr database.

The relationship between the prof_attr and the auth_attr databases is illustrated in the following example. The Device Management profile is defined in the prof_attr database as having all authorizations beginning with the solaris.device. string assigned to it. These authorizations are defined in the auth_attr database.

Execution Attributes

An execution attribute associated with a profile is a command (with any special security attributes) that can be run by those users or roles to whom the profile is assigned. Special security attributes refer to such attributes as UID, EUID, GID, EGID that can be added to a process when the command is run.

The definitions of the execution attributes are stored in the exec_attr database.

The fields in the exec_attr database are separated by colons:

name:policy:type:res1:res2:id:attr

The fields are described in the following table.

An exec_attr database with some typical values is shown in the following example.

The relationship between the exec_attr and the prof_attr databases is illustrated in the following example. The Printer Management profile is defined in the prof_attr database. It has 13 execution attributes with the appropriate security attributes assigned to it in the exec_attr database.

How to Assume Role-Based Access Control

To assume a role, use the su command. You cannot log in to a role. For example:

%su my-role
Password: my-role-password
#

To use commands in the profile, simply type into a shell. For example:

# lpadmin -p myprinter options

The lpadmin command is executed with any process attributes, special UIDs or GIDs, that have been assigned to the lpadmin command in profiles for the role assumed.

Tools for Managing Role-Based Access Control

In addition to editing the databases directly, the following tools are available for managing with role-based access control.