| Skip Navigation Links | |
| Exit Print View | |
|
Oracle Solaris 11.1 Administration: Security Services Oracle Solaris 11.1 Information Library |
| Skip Navigation Links | |
| Exit Print View | |
|
|
Oracle Solaris 11.1 Administration: Security Services Oracle Solaris 11.1 Information Library |
1. Security Services (Overview)
Part II System, File, and Device Security
2. Managing Machine Security (Overview)
3. Controlling Access to Systems (Tasks)
4. Virus Scanning Service (Tasks)
5. Controlling Access to Devices (Tasks)
6. Verifying File Integrity by Using BART (Tasks)
7. Controlling Access to Files (Tasks)
Part III Roles, Rights Profiles, and Privileges
8. Using Roles and Privileges (Overview)
9. Using Role-Based Access Control (Tasks)
10. Security Attributes in Oracle Solaris (Reference)
Viewing the Contents of Rights Profiles
Order of Search for Assigned Security Attributes
RBAC Databases and the Naming Services
Selected Commands That Require Authorizations
Administrative Commands for Handling Privileges
Files With Privilege Information
Prevention of Privilege Escalation
Legacy Applications and the Privilege Model
Part IV Cryptographic Services
11. Cryptographic Framework (Overview)
12. Cryptographic Framework (Tasks)
Part V Authentication Services and Secure Communication
14. Using Pluggable Authentication Modules
17. Using Simple Authentication and Security Layer
18. Network Services Authentication (Tasks)
19. Introduction to the Kerberos Service
20. Planning for the Kerberos Service
21. Configuring the Kerberos Service (Tasks)
22. Kerberos Error Messages and Troubleshooting
23. Administering Kerberos Principals and Policies (Tasks)
24. Using Kerberos Applications (Tasks)
25. The Kerberos Service (Reference)
An RBAC authorization is a discrete right that can be granted to a role or a user. Authorizations are checked by RBAC-compliant applications before a user gets access to the application or specific operations within the application.
Authorizations are user-level, therefore extensible. You can write a program that requires authorization, add the authorizations to your system, create a rights profile for these authorizations, and assign the rights profile to users or roles who are allowed to use the program.
An authorization has a name that is used internally. For example, solaris.system.date is the name of an authorization. An authorization has a short description, which appears in the graphical user interfaces (GUIs). For example, Set Date & Time is the description of the solaris.system.date authorization.
By convention, authorization names consist of the reverse order of the Internet name of the supplier, the subject area, any subareas, and the function. The parts of the authorization name are separated by dots. An example would be com.xyzcorp.device.access. Exceptions to this convention are the authorizations from Oracle, which use the prefix solaris instead of an Internet name. The naming convention enables administrators to apply authorizations in a hierarchical fashion. A wildcard (*) can represent any strings to the right of a dot.
As an example of how authorizations are used, consider the following: The Network Link Security rights profile has the solaris.network.link.security authorization only, while the Network Security rights profile has the Network Link Security profile as a supplementary profile, plus the solaris.network.* and solaris.smf.manage.ssh authorizations.
An authorization that ends with the suffix delegate enables a user or a role to delegate to other users any assigned authorizations that begin with the same prefix.
The solaris auth.delegate authorization enables a user or a role to delegate to other users any authorizations that these users or roles are assigned.
For example, a role with the solaris auth.delegate and solaris.network.wifi.wep authorizations can delegate the solaris.network.wifi.wep authorization to another user or role.
|