| blob | e36610fb01aeec6b24b0e0fba65e6ec974b88133 |
1 '\" te
2 .\" Copyright 1989 AT&T Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH ROLEADD 8 "Feb 25, 2017"
7 .SH NAME
8 roleadd \- administer a new role account on the system
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBroleadd\fR [\fB-c\fR \fIcomment\fR] [\fB-d\fR \fIdir\fR] [\fB-e\fR \fIexpire\fR] [\fB-f\fR \fIinactive\fR]
13 [\fB-g\fR \fIgroup\fR] [\fB-G\fR \fIgroup\fR [, \fIgroup\fR...]] [\fB-m\fR [\fB-k\fR \fIskel_dir\fR]]
14 [\fB-u\fR \fIuid\fR [\fB-o\fR]] [\fB-s\fR \fIshell\fR]
15 [\fB-A\fR \fIauthorization\fR [,\fIauthorization...\fR]] [\fB-K\fR \fIkey=value\fR] \fIrole\fR
16 .fi
18 .LP
19 .nf
20 \fBroleadd\fR \fB-D\fR [\fB-b\fR \fIbase_dir\fR] [\fB-e\fR \fIexpire\fR] [\fB-f\fR \fIinactive\fR]
21 [\fB-g\fR \fIgroup\fR] [\fB-A\fR \fIauthorization\fR [,\fIauthorization...\fR]]
22 [\fB-P\fR \fIprofile\fR [,\fIprofile...\fR] [\fB-K\fR \fIkey=value\fR]]
23 .fi
25 .SH DESCRIPTION
26 .LP
27 \fBroleadd\fR adds a role entry to the \fB/etc/passwd\fR and \fB/etc/shadow\fR
28 and \fB/etc/user_attr\fR files. The \fB-A\fR and \fB-P\fR options respectively
29 assign authorizations and profiles to the role. Roles cannot be assigned to
30 other roles. The \fB-K\fR option adds a \fIkey=value\fR pair to
31 \fB/etc/user_attr\fR for a role. Multiple \fIkey=value\fR pairs can be added
32 with multiple \fB-K\fR options.
33 .sp
34 .LP
35 \fBroleadd\fR also creates supplementary group memberships for the role
36 (\fB-G\fR option) and creates the home directory (\fB-m\fR option) for the role
37 if requested. The new role account remains locked until the \fBpasswd\fR(1)
38 command is executed.
39 .sp
40 .LP
41 Specifying \fBroleadd\fR \fB-D\fR with the \fB-g\fR, \fB-b\fR, \fB-f\fR,
42 \fB-e\fR, or \fB-K\fR option (or any combination of these option) sets the
43 default values for the respective fields. See the \fB-D\fR option. Subsequent
44 \fBroleadd\fR commands without the \fB-D\fR option use these arguments.
45 .sp
46 .LP
47 The system file entries created with this command have a limit of 512
48 characters per line. Specifying long arguments to several options can exceed
49 this limit.
50 .sp
51 .LP
52 The role (\fBrole\fR) field accepts a string of no more than eight bytes
53 consisting of characters from the set of alphabetic characters, numeric
54 characters, period (\fB\&.\fR), underscore (\fB_\fR), and hyphen (\fB-\fR). The
55 first character should be alphabetic and the field should contain at least one
56 lower case alphabetic character. A warning message is written if these
57 restrictions are not met. A future Solaris release might refuse to accept role
58 fields that do not meet these requirements.
59 .sp
60 .LP
61 The \fBrole\fR field must contain at least one character and must not contain a
62 colon (\fB:\fR) or a newline (\fB\en\fR).
63 .SH OPTIONS
64 .LP
65 The following options are supported:
66 .sp
67 .ne 2
68 .na
69 \fB\fB-A\fR \fIauthorization\fR\fR
70 .ad
71 .RS 20n
72 One or more comma separated authorizations defined in \fBauth_attr\fR(4). Only
73 a user or role who has grant rights to the authorization can assign it to an
74 account
75 .RE
77 .sp
78 .ne 2
79 .na
80 \fB\fB-b\fR \fIbase_dir\fR\fR
81 .ad
82 .RS 20n
83 The default base directory for the system if \fB-d\fR\fI dir\fR is not
84 specified. \fIbase_dir\fR is concatenated with the account name to define the
85 home directory. If the \fB-m\fR option is not used, \fIbase_dir\fR must exist.
86 .RE
88 .sp
89 .ne 2
90 .na
91 \fB\fB-c\fR \fIcomment\fR\fR
92 .ad
93 .RS 20n
94 Any text string. It is generally a short description of the role. This
95 information is stored in the role's \fB/etc/passwd\fR entry.
96 .RE
98 .sp
99 .ne 2
100 .na
101 \fB\fB-d\fR \fIdir\fR\fR
102 .ad
103 .RS 20n
104 The home directory of the new role. It defaults to
105 \fIbase_dir\fR/\fIaccount_name\fR, where \fIbase_dir\fR is the base directory
106 for new login home directories and \fIaccount_name\fR is the new role name.
107 .RE
109 .sp
110 .ne 2
111 .na
112 \fB\fB-D\fR\fR
113 .ad
114 .RS 20n
115 Display the default values for \fIgroup\fR, \fIbase_dir\fR, \fIskel_dir\fR,
116 \fIshell\fR, \fIinactive\fR, \fIexpire\fR and \fIkey=value\fR pairs. When used
117 with the \fB-g\fR, \fB-b\fR, \fB-f\fR, or \fB-K\fR, options, the \fB-D\fR
118 option sets the default values for the specified fields. The default values
119 are:
120 .sp
121 .ne 2
122 .na
123 \fBgroup\fR
124 .ad
125 .sp .6
126 .RS 4n
127 \fBother\fR (\fBGID\fR of 1)
128 .RE
130 .sp
131 .ne 2
132 .na
133 \fBbase_dir\fR
134 .ad
135 .sp .6
136 .RS 4n
137 \fB/home\fR
138 .RE
140 .sp
141 .ne 2
142 .na
143 \fBskel_dir\fR
144 .ad
145 .sp .6
146 .RS 4n
147 \fB/etc/skel\fR
148 .RE
150 .sp
151 .ne 2
152 .na
153 \fBshell\fR
154 .ad
155 .sp .6
156 .RS 4n
157 \fB/bin/pfsh\fR
158 .RE
160 .sp
161 .ne 2
162 .na
163 \fBinactive\fR
164 .ad
165 .sp .6
166 .RS 4n
167 \fB0\fR
168 .RE
170 .sp
171 .ne 2
172 .na
173 \fBexpire\fR
174 .ad
175 .sp .6
176 .RS 4n
177 Null
178 .RE
180 .sp
181 .ne 2
182 .na
183 \fBauths\fR
184 .ad
185 .sp .6
186 .RS 4n
187 Null
188 .RE
190 .sp
191 .ne 2
192 .na
193 \fBprofiles\fR
194 .ad
195 .sp .6
196 .RS 4n
197 Null
198 .RE
200 .sp
201 .ne 2
202 .na
203 \fBkey=value (pairs defined in \fBuser_attr\fR(4)\fR
204 .ad
205 .sp .6
206 .RS 4n
207 not present
208 .RE
210 .RE
212 .sp
213 .ne 2
214 .na
215 \fB\fB-e\fR \fIexpire\fR\fR
216 .ad
217 .RS 20n
218 Specify the expiration date for a role. After this date, no user is able to
219 access this role. The expire option argument is a date entered using one of the
220 date formats included in the template file \fB/etc/datemsk\fR. See
221 \fBgetdate\fR(3C).
222 .sp
223 If the date format that you choose includes spaces, it must be quoted. For
224 example, you can enter \fB10/6/90\fR or \fBOctober 6, 1990\fR. A null value
225 (\fB" "\fR) defeats the status of the expired date. This option is useful for
226 creating temporary roles.
227 .RE
229 .sp
230 .ne 2
231 .na
232 \fB\fB-f\fR \fIinactive\fR\fR
233 .ad
234 .RS 20n
235 The maximum number of days allowed between uses of a role ID before that ID is
236 declared invalid. Normal values are positive integers. A value of \fB 0\fR
237 defeats the status.
238 .RE
240 .sp
241 .ne 2
242 .na
243 \fB\fB-g\fR \fIgroup\fR\fR
244 .ad
245 .RS 20n
246 An existing group's integer ID or character-string name. Without the \fB-D\fR
247 option, it defines the new role's primary group membership and defaults to the
248 default group. You can reset this default value by invoking \fBroleadd
249 \fR\fB-D\fR\fB \fR\fB-g\fR\fB \fR\fIgroup.\fR
250 .RE
252 .sp
253 .ne 2
254 .na
255 \fB\fB-G\fR \fIgroup\fR\fR
256 .ad
257 .RS 20n
258 An existing group's integer \fBID\fR or character-string name. It defines the
259 new role's supplementary group membership. Duplicates between \fIgroup\fR with
260 the \fB-g\fR and \fB-G\fR options are ignored. No more than \fBNGROUPS_MAX\fR
261 groups can be specified.
262 .RE
264 .sp
265 .ne 2
266 .na
267 \fB\fB-k\fR \fIskel_dir\fR\fR
268 .ad
269 .RS 20n
270 A directory that contains skeleton information (such as \fB\&.profile\fR) that
271 can be copied into a new role's home directory. This directory must already
272 exist. The system provides the \fB/etc/skel\fR directory that can be used for
273 this purpose.
274 .RE
276 .sp
277 .ne 2
278 .na
279 \fB\fB-K\fR \fIkey=value\fR\fR
280 .ad
281 .RS 20n
282 A \fIkey=value\fR pair to add to the role's attributes. Multiple \fB-K\fR
283 options can be used to add multiple \fIkey=value\fR pairs. The generic \fB-K\fR
284 option with the appropriate key can be used instead of the specific implied key
285 options (\fB-A\fR and \fB-P\fR). See \fBuser_attr\fR(4) for a list of valid
286 \fIkey=value\fR pairs. The "type" key is not a valid key for this option. Keys
287 can not be repeated.
288 .RE
290 .sp
291 .ne 2
292 .na
293 \fB\fB-m\fR\fR
294 .ad
295 .RS 20n
296 Create the new role's home directory if it does not already exist. If the
297 directory already exists, it must have read, write, and execute permissions by
298 \fIgroup\fR, where \fIgroup\fR is the role's primary group.
299 .RE
301 .sp
302 .ne 2
303 .na
304 \fB\fB-o\fR\fR
305 .ad
306 .RS 20n
307 This option allows a \fBUID\fR to be duplicated (non-unique).
308 .RE
310 .sp
311 .ne 2
312 .na
313 \fB\fB-P\fR \fIprofile\fR\fR
314 .ad
315 .RS 20n
316 One or more comma-separated execution profiles defined in \fBprof_attr\fR(4).
317 .RE
319 .sp
320 .ne 2
321 .na
322 \fB\fB-s\fR \fIshell\fR\fR
323 .ad
324 .RS 20n
325 Full pathname of the program used as the user's shell on login. It defaults to
326 an empty field causing the system to use \fB/bin/pfsh\fR as the default. The
327 value of \fIshell\fR must be a valid executable file.
328 .RE
330 .sp
331 .ne 2
332 .na
333 \fB\fB-u\fR \fIuid\fR\fR
334 .ad
335 .RS 20n
336 The \fBUID\fR of the new role. This \fBUID\fR must be a non-negative decimal
337 integer below \fBMAXUID\fR as defined in \fB<sys/param.h>\fR\&. The \fBUID\fR
338 defaults to the next available (unique) number above the highest number
339 currently assigned. For example, if \fBUID\fRs 100, 105, and 200 are assigned,
340 the next default \fBUID\fR number is 201. (\fBUID\fRs from \fB0\fR-\fB99\fR are
341 reserved for possible use in future applications.)
342 .RE
344 .SH FILES
345 .LP
346 \fB/etc/datemsk\fR
347 .sp
348 .LP
349 \fB/etc/passwd\fR
350 .sp
351 .LP
352 \fB/etc/shadow\fR
353 .sp
354 .LP
355 \fB/etc/group\fR
356 .sp
357 .LP
358 \fB/etc/skel\fR
359 .sp
360 .LP
361 \fB/usr/include/limits.h\fR
362 .sp
363 .LP
364 \fB/etc/user_attr\fR
365 .SH ATTRIBUTES
366 .LP
367 See \fBattributes\fR(5) for descriptions of the following attributes:
368 .sp
370 .sp
371 .TS
372 box;
373 c | c
374 l | l .
375 ATTRIBUTE TYPE ATTRIBUTE VALUE
376 _
377 Interface Stability Evolving
378 .TE
380 .SH SEE ALSO
381 .LP
382 \fBpasswd\fR(1), \fBpfsh\fR(1), \fBprofiles\fR(1), \fBroles\fR(1),
383 \fBusers\fR(1B), \fBgroupadd\fR(8), \fBgroupdel\fR(8), \fBgroupmod\fR(8),
384 \fBgrpck\fR(8), \fBlogins\fR(8), \fBpwck\fR(8), \fBuserdel\fR(8),
385 \fBusermod\fR(8), \fBgetdate\fR(3C), \fBauth_attr\fR(4), \fBpasswd\fR(4),
386 \fBprof_attr\fR(4), \fBuser_attr\fR(4), \fBattributes\fR(5)
387 .SH DIAGNOSTICS
388 .LP
389 In case of an error, \fBroleadd\fR prints an error message and exits with a
390 non-zero status.
391 .sp
392 .LP
393 The following indicates that \fBlogin\fR specified is already in use:
394 .sp
395 .in +2
396 .nf
397 UX: roleadd: ERROR: login is already in use. Choose another.
398 .fi
399 .in -2
400 .sp
402 .sp
403 .LP
404 The following indicates that the \fIuid\fR specified with the \fB-u\fR option
405 is not unique:
406 .sp
407 .in +2
408 .nf
409 UX: roleadd: ERROR: uid \fIuid\fR is already in use. Choose another.
410 .fi
411 .in -2
412 .sp
414 .sp
415 .LP
416 The following indicates that the \fIgroup\fR specified with the \fB-g\fR option
417 is already in use:
418 .sp
419 .in +2
420 .nf
421 UX: roleadd: ERROR: group \fIgroup\fR does not exist. Choose another.
422 .fi
423 .in -2
424 .sp
426 .sp
427 .LP
428 The following indicates that the \fIuid\fR specified with the \fB-u\fR option
429 is in the range of reserved \fBUID\fRs (from \fB0\fR-\fB99\fR):
430 .sp
431 .in +2
432 .nf
433 UX: roleadd: WARNING: uid \fIuid\fR is reserved.
434 .fi
435 .in -2
436 .sp
438 .sp
439 .LP
440 The following indicates that the \fIuid\fR specified with the \fB-u\fR option
441 exceeds \fBMAXUID\fR as defined in \fB<sys/param.h>\fR:
442 .sp
443 .in +2
444 .nf
445 UX: roleadd: ERROR: uid \fIuid\fR is too big. Choose another.
446 .fi
447 .in -2
448 .sp
450 .sp
451 .LP
452 The following indicates that the \fB/etc/passwd\fR or \fB/etc/shadow\fR files
453 do not exist:
454 .sp
455 .in +2
456 .nf
457 UX: roleadd: ERROR: Cannot update system files - login cannot be created.
458 .fi
459 .in -2
460 .sp
462 .SH NOTES
463 .LP
464 If a network nameservice is being used to supplement the local
465 \fB/etc/passwd\fR file with additional entries, \fBroleadd\fR cannot change
466 information supplied by the network nameservice.