RBAC Commands

This section lists commands that are used to administer RBAC. Also provided is a table of commands whose access can be controlled by authorizations.

Commands That Manage RBAC

The following commands retrieve and set RBAC information.

Table 10-1 RBAC Administration Commands

Man Page for Command	Description
`auths`(1)	Displays authorizations for a user.
`getent`(1M)	Interface to list the contents of the `user_attr`, `prof_attr`, and `exec_attr` databases.
`nscd`(1M)	Name service cache daemon, useful for caching the `user_attr`, `prof_attr`, and `exec_attr` databases. Use the `svcadm` command to restart the daemon.
`pam_roles`(5)	Role account management module for PAM. Checks for the authorization to assume role.
`pfedit`(1M)	Used to edit system files by non-`root` users when they are assigned the `solaris.admin.edit/path-to-system-file` authorization.
`pfexec`(1)	Used by profile shells to execute commands with security attributes that are specified in the `exec_attr` database.
`policy.conf`(4)	Configuration file for system security policy. Lists granted authorizations, granted privileges, and other security information.
`profiles`(1)	Displays rights profiles for a specified user. Creates or modifies a rights profile on a local system or an LDAP network.
`roles`(1)	Displays roles that a specified user can assume.
`roleadd`(1M)	Adds a role to a local system or to an LDAP network.
`roleadd`(1M)	Adds a role to a local system or to an LDAP network.
`rolemod`(1M)	Modifies a role's properties on a local system or on an LDAP network.
`userattr`(1)	Displays the value of a specific right that is assigned to a user or role account.
`useradd`(1M)	Adds a user account to the system or to an LDAP network. The `-R` option assigns a role to a user's account.
`userdel`(1M)	Deletes a user's login from the system or from an LDAP network.
`usermod`(1M)	Modifies a user's account properties on the system.

Selected Commands That Require Authorizations

The following table provides examples of how authorizations are used to limit command options on an Oracle Solaris system. For more discussion of authorizations, see Authorizations.

Table 10-2 Commands and Associated Authorizations

Man Page for Command	Authorization Requirements
`at`(1)	`solaris.jobs.user` required for all options (when neither `at.allow` nor `at.deny` files exist)
`atq`(1)	`solaris.jobs.admin` required for all options
`cdrw`(1)	`solaris.device.cdrw` required for all options, and is granted by default in the `policy.conf` file
`crontab`(1)	`solaris.jobs.user` required for the option to submit a job (when neither `crontab.allow` nor `crontab.deny` files exist) `solaris.jobs.admin` required for the options to list or modify other users' `crontab` files
`allocate`(1)	`solaris.device.allocate` (or other authorization as specified in `device_allocate` file) required to allocate a device `solaris.device.revoke` (or other authorization as specified in `device_allocate` file) required to allocate a device to another user (`-F` option)
`deallocate`(1)	`solaris.device.allocate` (or other authorization as specified in `device_allocate` file) required to deallocate another user's device `solaris.device.revoke` (or other authorization as specified in `device_allocate`) required to force deallocation of the specified device (`-F` option) or all devices (`-I` option)
`list_devices`(1)	`solaris.device.revoke` required to list another user's devices (`-U` option)
`roleadd`(1M)	`solaris.user.manage` required to create a role. `solaris.account.activate` required to set the initial password. `solaris.account.setpolicy` required to set password policy, such as account locking and password aging.
`roledel`(1M)	`solaris.passwd.assign` authorization required to delete the password.
`rolemod`(1M)	`solaris.passwd.assign` authorization required to change the password. `solaris.account.setpolicy` required to change password policy, such as account locking and password aging.
`sendmail`(1M)	`solaris.mail` required to access mail subsystem functions; `solaris.mail.mailq` required to view mail queue
`useradd`(1M)	`solaris.user.manage` required to create a user. `solaris.account.activate` required to set the initial password. `solaris.account.setpolicy` required to set password policy, such as account locking and password aging.
`userdel`(1M)	`solaris.passwd.assign` authorization required to delete the password.
`usermod`(1M)	`solaris.passwd.assign` authorization required to change the password. `solaris.account.setpolicy` required to change password policy, such as account locking and password aging.

Skip Navigation Links
Exit Print View
	Oracle Solaris 11.1 Administration: Security Services Oracle Solaris 11.1 Information Library