Using Rights Profiles to Install and Manage Zones
Oracle Solaris implements role-based access control (RBAC) to control system access. To perform specific tasks and run privileged commands on the system, a user must have the profiles that provide that user the proper authorization. RBAC also applies when working with zones. This section describes how to authorize sample user jdoe
to work with zones.
Provided that you have the solaris.delegate.*
authorization, you can assign one or all of the following zone-related profiles to jdoe
.
-
Zone Configuration enables
jdoe
to configure Oracle Solaris zones on a client system, including zones that are migrated into the system but remain unconfigured. -
Zone Management enables
jdoe
to manage existing zones, including runningzoneadm
commands as well as logging in to the zones. -
Zone Migration enables
jdoe
to perform live, warm, and cold zone migrations. -
Zone Cold Migration enables
jdoe
to perform cold and warm migrations, but not live migrations. -
Zone Security extends
jdoe
's zone administrative privileges to include zones that are configured with Trusted Extensions. For example, the user with this profile can issuetxzonemgr
commands. For information abouttxzonemgr
, see Creating Labeled Zones in Trusted Extensions Configuration and Administration
A zone administrator that has any of these profiles must be in a profile shell to execute privileged zone commands. The shell can be created by issuing the pf
shell command, for example, pfbash
. Outside a profile shell, the administrator would need to specify pfexec
when issuing a privileged command, for example, pfexec zoneadm
.
As an alternative to directly assigning profiles, you can create a role that would contain a combination of required profiles to perform a range of tasks, and then assign the role to the designated zone administrator.
For example, you create a special role zoneadmin
with authorization to perform a variety of zone related tasks. User jdoe
then issues the su
command to assume the zoneadmin
role to manage the zones. All roles automatically get pfbash
as the default shell.
For more information about rights profiles, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.4.
Later, a zone administrator can implement RBAC inside the running zone to manage users, rights, profiles, and roles to secure the zone. See examples in Authorizing Non-Root Users to Perform Non-Global Zone Migrations.