| blob | eecb263741c294a7ba64619a1c8efbd6021f3a28 |
1 '\" te
2 .\" Copyright (C) 2008 Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH USER_ATTR 4 "Dec 12, 2008"
7 .SH NAME
8 user_attr \- extended user attributes database
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/etc/user_attr\fR
13 .fi
15 .SH DESCRIPTION
16 .sp
17 .LP
18 \fB/etc/user_attr\fR is a local source of extended attributes associated with
19 users and roles. \fBuser_attr\fR can be used with other user attribute sources,
20 including the LDAP people container, the \fBuser_attr\fR \fBNIS\fR map, and the
21 \fBuser_attr\fR \fBNIS+\fR table. Programs use the \fBgetuserattr\fR(3SECDB)
22 routines to gain access to this information.
23 .sp
24 .LP
25 The search order for multiple \fBuser_attr\fR sources is specified in the
26 \fB/etc/nsswitch.conf\fR file, as described in the \fBnsswitch.conf\fR(4) man
27 page. The search order follows that for \fBpasswd\fR(4).
28 .sp
29 .LP
30 Each entry in the \fBuser_attr\fR databases consists of a single line with five
31 fields separated by colons (\fB:\fR). Line continuations using the backslash
32 (\fB\e\fR) character are permitted. Each entry has the form:
33 .sp
34 .in +2
35 .nf
36 \fIuser\fR:\fIqualifier\fR:\fIres1\fR:\fIres2\fR:\fIattr\fR
37 .fi
38 .in -2
40 .sp
41 .ne 2
42 .na
43 \fB\fIuser\fR\fR
44 .ad
45 .sp .6
46 .RS 4n
47 The name of the user as specified in the \fBpasswd\fR(4) database.
48 .RE
50 .sp
51 .ne 2
52 .na
53 \fB\fIqualifier\fR\fR
54 .ad
55 .sp .6
56 .RS 4n
57 Reserved for future use.
58 .RE
60 .sp
61 .ne 2
62 .na
63 \fB\fIres1\fR\fR
64 .ad
65 .sp .6
66 .RS 4n
67 Reserved for future use.
68 .RE
70 .sp
71 .ne 2
72 .na
73 \fB\fIres2\fR\fR
74 .ad
75 .sp .6
76 .RS 4n
77 Reserved for future use.
78 .RE
80 .sp
81 .ne 2
82 .na
83 \fB\fIattr\fR\fR
84 .ad
85 .sp .6
86 .RS 4n
87 An optional list of semicolon-separated (\fB;\fR) key-value pairs that describe
88 the security attributes to apply to the object upon execution. Zero or more
89 keys may be specified. The following keys are currently interpreted by the
90 system:
91 .sp
92 .ne 2
93 .na
94 \fB\fBauths\fR\fR
95 .ad
96 .sp .6
97 .RS 4n
98 Specifies a comma-separated list of authorization names chosen from those names
99 defined in the \fBauth_attr\fR(4) database. Authorization names may be
100 specified using the asterisk (\fB*\fR) character as a wildcard. For example,
101 \fBsolaris.printer.*\fR means all of Sun's printer authorizations.
102 .RE
104 .sp
105 .ne 2
106 .na
107 \fB\fBprofiles\fR\fR
108 .ad
109 .sp .6
110 .RS 4n
111 Contains an ordered, comma-separated list of profile names chosen from
112 \fBprof_attr\fR(4). Profiles are enforced by the profile shells, \fBpfcsh\fR,
113 \fBpfksh\fR, and \fBpfsh\fR. See \fBpfsh\fR(1). A default profile is assigned
114 in \fB/etc/security/policy.conf\fR (see \fBpolicy.conf\fR(4)). If no profiles
115 are assigned, the profile shells do not allow the user to execute any commands.
116 .RE
118 .sp
119 .ne 2
120 .na
121 \fB\fBroles\fR\fR
122 .ad
123 .sp .6
124 .RS 4n
125 Can be assigned a comma-separated list of role names from the set of user
126 accounts in this database whose \fBtype\fR field indicates the account is a
127 role. If the \fBroles\fR key value is not specified, the user is not permitted
128 to assume any role.
129 .RE
131 .sp
132 .ne 2
133 .na
134 \fB\fBtype\fR\fR
135 .ad
136 .sp .6
137 .RS 4n
138 Can be assigned one of these strings: \fBnormal\fR, indicating that this
139 account is for a normal user, one who logs in; or \fBrole\fR, indicating that
140 this account is for a role. Roles can only be assumed by a normal user after
141 the user has logged in.
142 .RE
144 .sp
145 .ne 2
146 .na
147 \fB\fBproject\fR\fR
148 .ad
149 .sp .6
150 .RS 4n
151 Can be assigned a name of one project from the \fBproject\fR(4) database to be
152 used as a default project to place the user in at login time. For more
153 information, see \fBgetdefaultproj\fR(3PROJECT).
154 .RE
156 .sp
157 .ne 2
158 .na
159 \fB\fBdefaultpriv\fR\fR
160 .ad
161 .sp .6
162 .RS 4n
163 The default set of privileges assigned to a user's inheritable set upon login.
164 See "Privileges Keywords," below.
165 .RE
167 .sp
168 .ne 2
169 .na
170 \fB\fBlimitpriv\fR\fR
171 .ad
172 .sp .6
173 .RS 4n
174 The maximum set of privileges a user or any process started by the user,
175 whether through \fBsu\fR(1M) or any other means, can obtain. The system
176 administrator must take extreme care when removing privileges from the limit
177 set. Removing any basic privilege has the ability of crippling all
178 applications; removing any other privilege can cause many or all applications
179 requiring privileges to malfunction. See "Privileges Keywords," below.
180 .RE
182 .sp
183 .ne 2
184 .na
185 \fB\fBlock_after_retries\fR\fR
186 .ad
187 .sp .6
188 .RS 4n
189 Specifies whether an account is locked after the count of failed logins for a
190 user equals or exceeds the allowed number of retries as defined by
191 \fBRETRIES\fR in \fB/etc/default/login\fR. Possible values are \fByes\fR or
192 \fBno\fR. The default is \fBno\fR. Account locking is applicable only to local
193 accounts.
194 .RE
196 .sp
197 .LP
198 Except for the \fBtype\fR key, the \fB\fIkey\fR=\fIvalue\fR\fR fields in
199 \fB/etc/user_attr\fR can be added using \fBroleadd\fR(1M) and
200 \fBuseradd\fR(1M). You can use \fBrolemod\fR(1M) and \fBusermod\fR(1M) to
201 modify \fB\fIkey\fR=\fIvalue\fR\fR fields in \fB/etc/user_attr\fR. Modification
202 of the \fBtype\fR key is restricted as described in \fBrolemod\fR and
203 \fBusermod\fR.
204 .SS "Privileges Keywords"
205 .sp
206 .LP
207 The \fBdefaultpriv\fR and \fBlimitpriv\fR are the privileges-related keywords
208 and are described above.
209 .sp
210 .LP
211 See \fBprivileges\fR(5) for a description of privileges. The command
212 \fBppriv\fR \fB-l\fR (see \fBppriv\fR(1)) produces a list of all supported
213 privileges. Note that you specify privileges as they are displayed by
214 \fBppriv\fR. In \fBprivileges\fR(5), privileges are listed in the form
215 \fBPRIV_\fR\fI<privilege_name>\fR\&. For example, the privilege
216 \fBfile_chown\fR, as you would specify it in \fBuser_attr\fR, is listed in
217 \fBprivileges\fR(5) as \fBPRIV_FILE_CHOWN\fR.
218 .sp
219 .LP
220 Privileges are specified through the Solaris Management Console
221 (\fBsmc\fR(1M)), the recommended method, or, on the command line, for users,
222 through\fBusermod\fR(1M). See \fBusermod\fR(1M) for examples of commands that
223 modify privileges and their subsequent effect on \fBuser_attr\fR.
224 .SH EXAMPLES
225 .LP
226 \fBExample 1 \fRAssigning a Profile to Root
227 .sp
228 .LP
229 The following example entry assigns to root the \fBAll\fR profile, which allows
230 root to use all commands in the system, and also assigns two authorizations:
232 .sp
233 .in +2
234 .nf
235 root::::auths=solaris.*,solaris.grant;profiles=All;type=normal
236 .fi
237 .in -2
239 .sp
240 .LP
241 The \fBsolaris.*\fR wildcard authorization shown above gives root all the
242 \fBsolaris\fR authorizations; and the \fBsolaris.grant\fR authorization gives
243 root the right to grant to others any \fBsolaris\fR authorizations that root
244 has. The combination of authorizations enables root to grant to others all the
245 \fBsolaris\fR authorizations. See \fBauth_attr\fR(4) for more about
246 authorizations.
248 .SH FILES
249 .sp
250 .ne 2
251 .na
252 \fB\fB/etc/nsswitch.conf\fR\fR
253 .ad
254 .sp .6
255 .RS 4n
256 See \fBnsswitch.conf\fR(4).
257 .RE
259 .sp
260 .ne 2
261 .na
262 \fB\fB/etc/user_attr\fR\fR
263 .ad
264 .sp .6
265 .RS 4n
266 Described here.
267 .RE
269 .SH ATTRIBUTES
270 .sp
271 .LP
272 See \fBattributes\fR(5) for descriptions of the following attributes:
273 .sp
275 .sp
276 .TS
277 box;
278 c | c
279 l | l .
280 ATTRIBUTE TYPE ATTRIBUTE VALUE
281 _
282 Availibility SUNWcsr
283 _
284 Interface Stability See below
285 .TE
287 .sp
288 .LP
289 The command-line syntax is Committed. The output is Uncommitted.
290 .SH SEE ALSO
291 .sp
292 .LP
293 \fBauths\fR(1), \fBpfcsh\fR(1), \fBpfksh\fR(1), \fBpfsh\fR(1), \fBppriv\fR(1),
294 \fBprofiles\fR(1), \fBroles\fR(1), \fBroleadd\fR(1M), \fBrolemod\fR(1M),
295 \fBuseradd\fR(1M), \fBusermod\fR(1M), \fBgetdefaultproj\fR(3PROJECT),
296 \fBgetuserattr\fR(3SECDB), \fBauth_attr\fR(4), \fBexec_attr\fR(4),
297 \fBnsswitch.conf\fR(4), \fBpasswd\fR(4), \fBpolicy.conf\fR(4),
298 \fBprof_attr\fR(4), \fBproject\fR(4), \fBattributes\fR(5), \fBprivileges\fR(5)
299 .sp
300 .LP
301 \fISystem Administration Guide: Security Services\fR
302 .SH NOTES
303 .sp
304 .LP
305 When deciding which authorization source to use, if you are not using LDAP,
306 keep in mind that \fBNIS+\fR provides stronger authentication than \fBNIS\fR.
307 .sp
308 .LP
309 The root user is usually defined in local databases for a number of reasons,
310 including the fact that root needs to be able to log in and do system
311 maintenance in single-user mode, before the network name service databases are
312 available. For this reason, an entry should exist for root in the local
313 \fBuser_attr\fR file, and the precedence shown in the example
314 \fBnsswitch.conf\fR(4) file entry under EXAMPLES is highly recommended.
315 .sp
316 .LP
317 Because the list of legal keys is likely to expand, any code that parses this
318 database must be written to ignore unknown key-value pairs without error. When
319 any new keywords are created, the names should be prefixed with a unique
320 string, such as the company's stock symbol, to avoid potential naming
321 conflicts.
322 .sp
323 .LP
324 In the \fBattr\fR field, escape the following symbols with a backslash
325 (\fB\e\fR) if you use them in any value: colon (\fB:\fR), semicolon (\fB;\fR),
326 carriage return (\fB\en\fR), equals (\fB=\fR), or backslash (\fB\e\fR).