exec_attr

- execution profiles database

Synopsis

/etc/security/exec_attr 

Description

/etc/security/exec_attr is a local database that specifies the execution attributes associated with profiles. The exec_attr file can be used with other sources for execution profiles, including the exec_attr NIS map. Programs use the getexecattr(3C) routines to access this information.

The search order for multiple execution profile sources is specified in the /etc/nsswitch.conf file, as described in the nsswitch.conf(4) man page. The search order follows the entry for prof_attr(4).

A profile is a logical grouping of authorizations and commands that is interpreted by a profile shell to form a secure execution environment. The shells that interpret profiles are pfcsh, pfksh, and pfsh. See the pfsh(1) man page. Each user's account is assigned zero or more profiles in the user_attr(4) database file.

Each entry in the exec_attr database consists of one line of text containing seven fields separated by colons (:). Line continuations using the backslash (\) character are permitted. The basic format of each entry is:

name:policy:type:res1:res2:id:attr

name

The name of the profile. Profile names are case-sensitive.

policy

The security policy that is associated with the profile entry. The valid policy type is solaris. The solaris policy recognizes privileges. See privileges(5).

type

The type of object defined in the profile. The valid type is cmd. The cmd type specifies that the ID field is a command that would be executed by a shell.

res1

The characters RO in this field indicate it is read only and not modifiable by the tools that update this database.

res2

Reserved for future use.

id

A string that uniquely identifies the object described by the profile. For a profile of type cmd, the id is either the full path to the command or the asterisk (*) symbol, which is used to allow all commands. An asterisk that replaces the filename component in a pathname indicates all files in a particular directory.

To specify arguments, the pathname should point to a shell script that is written to execute the command with the desired argument. In a Bourne shell, the effective UID is reset to the real UID of the process when the effective UID is less than 100 and not equal to the real UID. Depending on the euid and egid values, Bourne shell limitations might make other shells preferable. To prevent the effective UIDs from being reset to real UIDs, you can start the script with the -p option.

#!/bin/sh -p

attr

An optional list of semicolon-separated (;) key-value pairs that describe the security attributes to apply to the object upon execution. Zero or more keys can be specified. The list of valid key words depends on the policy enforced. The following key words are valid: euid, uid, egid, gid, privs, and limitprivs.

euid and uid contain a single user name or a numeric user ID. Commands designated with euid run with the effective UID indicated, which is similar to setting the setuid bit on an executable file. Commands designated with uid run with both the real and effective UIDs. Setting uid might be more appropriate than setting the euid on privileged shell scripts.

egid and gid contain a single group name or a numeric group ID. Commands designated with egid run with the effective GID indicated, which is similar to setting the setgid bit on a file. Commands designated with gid run with both the real and effective GIDs. Setting gid might be more appropriate than setting guid on privileged shell scripts.

privs contains a privilege set which are added to the inheritable set prior to running the command.

limitprivs contains a privilege set which are assigned to the limit set prior to running the command.

privs and limitprivs are only valid for the solaris policy.

Examples

Example 1 Using Privileges

The following example shows the audit command specified in the Audit Control profile to execute with the proc_owner privilege:

Audit Control:solaris:cmd:::/usr/sbin/audit:privs=proc_owner

Files

/etc/nsswitch.conf

/etc/user_attr

/etc/security/exec_attr

Locally added entries. Make sure that the shipped header remains intact.

/etc/security/exec_attr.d/*

Entries added by package installation.

Attributes

See attributes(5) for descriptions of the following attributes:

The command-line syntax is Committed. The output is Uncommitted.

Notes

Because the list of legal keys is likely to expand, any code that parses this database must be written to ignore unknown key-value pairs without error. When any new keywords are created, the names should be prefixed with a unique string, such as the company's stock symbol, to avoid potential naming conflicts.

The following characters are used in describing the database format and must be escaped with a backslash if used as data: colon (:), semicolon (;), equals (=), and backslash (\).

Authorizations required to set various fields are listed:

name       profile name            solaris.profile.cmd.manage
policy     security policy         solaris.profile.cmd.manage
type       type of object defined  solaris.profile.cmd.manage
             in the profile
id full path of command            solaris.profile.cmd.manage

attr security attributes of the command

euid        euid of the command      solaris.profile.cmd.setuid
            process
uid         uid of the command       solaris.profile.cmd.setuid
            process
egid        egid of the command      solaris.group.assign/delegate
            process
gid         gid of the command       solaris.group.assign/delegate
            process
privs       privileges added to 
            the inheritable set of   solaris.privilege.assign/delegate
            privileges for the 
            command. An Extended
            Policy can be specified
            here. See privileges.5.
limitprivs  privileges assigned to
            the limit set of         solaris.privilege.assign/delegate
            privileges for the 
            command

The value of limitprivs that can be set by an authorized user for a given command are limited to the limitprivs privileges that are granted to the user.

The value of the privs that can be set by an authorized user for a given command are limited to the defaultprivs privileges granted to the user.

The solaris.privilege.assign authorization allows the authorized user to grant any privilege to a user. The solaris.privilege.delegate allows the authorized user to grant privileges from the user's privilege sets. See group(4) for more information on solaris.group.assign/delegate.

See Also

auths(1), profiles(1), roles(1), sh(1), makedbm(1M), getauthattr(3C), getexecattr(3C), getprofattr(3C), getuserattr(3C), kva_match(3C), auth_attr(4), group(4), prof_attr(4), user_attr(4), attributes(5), privileges(5)