| blob | 141f159299d38b44b8864d77b47d9a00e2fc95ae |
1 '\" te
2 .\" Copyright 1989 AT&T Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH ROLEMOD 8 "Dec 10, 2008"
7 .SH NAME
8 rolemod \- modify a role's login information on the system
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBrolemod\fR [\fB-u\fR \fIuid\fR [\fB-o\fR]] [\fB-g\fR \fIgroup\fR] [\fB-G\fR \fIgroup\fR [, \fIgroup\fR...]]
13 [\fB-d\fR \fIdir\fR [\fB-m\fR]] [\fB-s\fR \fIshell\fR] [\fB-c\fR \fIcomment\fR] [\fB-l\fR \fInew_name\fR]
14 [\fB-f\fR \fIinactive\fR] [\fB-e\fR \fIexpire\fR]
15 [\fB-A\fR \fIauthorization\fR [, \fIauthorization\fR]]
16 [\fB-P\fR \fIprofile\fR [, \fIprofile\fR]] [\fB-K\fR \fIkey=value\fR] \fIrole\fR
17 .fi
19 .SH DESCRIPTION
20 .sp
21 .LP
22 The \fBrolemod\fR utility modifies a role's login information on the system. It
23 changes the definition of the specified login and makes the appropriate
24 login-related system file and file system changes.
25 .sp
26 .LP
27 The system file entries created with this command have a limit of 512
28 characters per line. Specifying long arguments to several options may exceed
29 this limit.
30 .SH OPTIONS
31 .sp
32 .LP
33 The following options are supported:
34 .sp
35 .ne 2
36 .na
37 \fB\fB-A\fR \fIauthorization\fR\fR
38 .ad
39 .sp .6
40 .RS 4n
41 One or more comma separated authorizations as deined in \fBauth_attr\fR(4).
42 Only role with \fBgrant\fR rights to the \fBauthorization\fR can assign it to
43 an account. This replaces any existing authorization setting. If no
44 authorization list is specified, the existing setting is removed.
45 .RE
47 .sp
48 .ne 2
49 .na
50 \fB\fB-c\fR \fIcomment\fR\fR
51 .ad
52 .sp .6
53 .RS 4n
54 Specify a comment string. \fIcomment\fR can be any text string. It is generally
55 a short description of the login, and is currently used as the field for the
56 user's full name. This information is stored in the user's \fB/etc/passwd\fR
57 entry.
58 .RE
60 .sp
61 .ne 2
62 .na
63 \fB\fB-d\fR \fIdir\fR\fR
64 .ad
65 .sp .6
66 .RS 4n
67 Specify the new home directory of the role. It defaults to
68 \fIbase_dir/login\fR, where \fIbase_dir\fR is the base directory for new login
69 home directories, and \fBlogin\fR is the new login.
70 .RE
72 .sp
73 .ne 2
74 .na
75 \fB\fB-e\fR \fIexpire\fR\fR
76 .ad
77 .sp .6
78 .RS 4n
79 Specify the expiration date for a role. After this date, no role will be able
80 to access this login. The expire option argument is a date entered using one of
81 the date formats included in the template file \fB/etc/datemsk\fR. See
82 \fBgetdate\fR(3C).
83 .sp
84 For example, you may enter \fB10/6/90\fR or \fBOctober 6, 1990\fR. A value of
85 \fB`` ''\fR defeats the status of the expired date.
86 .RE
88 .sp
89 .ne 2
90 .na
91 \fB\fB-f\fR \fIinactive\fR\fR
92 .ad
93 .sp .6
94 .RS 4n
95 Specify the maximum number of days allowed between uses of a login \fBID\fR
96 before that login \fBID\fR is declared invalid. Normal values are positive
97 integers. A value of \fB0\fR defeats the status.
98 .RE
100 .sp
101 .ne 2
102 .na
103 \fB\fB-g\fR \fIgroup\fR\fR
104 .ad
105 .sp .6
106 .RS 4n
107 Specify an existing group's integer \fBID\fR or character-string name. It
108 redefines the role's primary group membership.
109 .RE
111 .sp
112 .ne 2
113 .na
114 \fB\fB-G\fR \fIgroup\fR\fR
115 .ad
116 .sp .6
117 .RS 4n
118 Specify an existing group's integer ID or character string name. It redefines
119 the role's supplementary group membership. Duplicates between \fIgroup\fR with
120 the \fB-g\fR and \fB-G\fR options are ignored. No more than \fBNGROUPS_UMAX\fR
121 groups may be specified as defined in \fB<param.h>\fR\&.
122 .RE
124 .sp
125 .ne 2
126 .na
127 \fB\fB-K\fR \fIkey=value\fR\fR
128 .ad
129 .sp .6
130 .RS 4n
131 Replace existing or add to a role's \fIkey=value\fR pair attributes. Multiple
132 \fB-K\fR options can be used to replace or add multiple \fIkey=value\fR pairs.
133 However, keys must not be repeated. The generic \fB-K\fR option with the
134 appropriate key may be used instead of the specific implied key options
135 (\fB-A\fR and \fB-P\fR). See \fBuser_attr\fR(4) for a list of valid
136 \fIkey=value\fR pairs.
137 .sp
138 The keyword \fBtype\fR can be specified with the value \fBrole\fR or the value
139 \fBnormal\fR. When using the value \fBnormal\fR, the account changes from a
140 role user to a normal user; using the value \fBrole\fR keeps the account a role
141 user.
142 .RE
144 .sp
145 .ne 2
146 .na
147 \fB\fB-l\fR \fInew_logname\fR\fR
148 .ad
149 .sp .6
150 .RS 4n
151 Specify the new login name for the role. The \fInew_logname\fR argument is a
152 string no more than eight bytes consisting of characters from the set of
153 alphabetic characters, numeric characters, period (\fB\&.\fR), underline
154 (\fB_\fR), and hypen (\fB\(mi\fR). The first character should be alphabetic and
155 the field should contain at least one lower case alphabetic character. A
156 warning message will be written if these restrictions are not met. A future
157 Solaris release may refuse to accept login fields that do not meet these
158 requirements. The \fInew_logname\fR argument must contain at least one
159 character and must not contain a colon (\fB:\fR) or \fBNEWLINE\fR (\fB\en\fR).
160 .RE
162 .sp
163 .ne 2
164 .na
165 \fB\fB-m\fR\fR
166 .ad
167 .sp .6
168 .RS 4n
169 Move the role's home directory to the new directory specified with the \fB-d\fR
170 option. If the directory already exists, it must have permissions
171 read/write/execute by \fIgroup\fR, where \fIgroup\fR is the role's primary
172 group.
173 .RE
175 .sp
176 .ne 2
177 .na
178 \fB\fB-o\fR\fR
179 .ad
180 .sp .6
181 .RS 4n
182 This option allows the specified \fBUID\fR to be duplicated (non-unique).
183 .RE
185 .sp
186 .ne 2
187 .na
188 \fB\fB-P\fR \fIprofile\fR\fR
189 .ad
190 .sp .6
191 .RS 4n
192 One or more comma-separated execution profiles defined in \fBauth_attr\fR(4).
193 This replaces any existing profile setting. If no profile list is specified,
194 the existing setting is removed.
195 .RE
197 .sp
198 .ne 2
199 .na
200 \fB\fB-s\fR \fIshell\fR\fR
201 .ad
202 .sp .6
203 .RS 4n
204 Specify the full pathname of the program that is used as the role's shell on
205 login. The value of \fIshell\fR must be a valid executable file.
206 .RE
208 .sp
209 .ne 2
210 .na
211 \fB\fB-u\fR \fIuid\fR\fR
212 .ad
213 .sp .6
214 .RS 4n
215 Specify a new \fBUID\fR for the role. It must be a non-negative decimal integer
216 less than \fBMAXUID\fR as defined in \fB<param.h>\fR\&. The \fBUID\fR
217 associated with the role's home directory is not modified with this option; a
218 role will not have access to their home directory until the \fBUID\fR is
219 manually reassigned using \fBchown\fR(1).
220 .RE
222 .SH OPERANDS
223 .sp
224 .LP
225 The following operands are supported:
226 .sp
227 .ne 2
228 .na
229 \fB\fBlogin\fR\fR
230 .ad
231 .sp .6
232 .RS 4n
233 An existing login name to be modified.
234 .RE
236 .SH EXIT STATUS
237 .sp
238 .LP
239 In case of an error, \fBrolemod\fR prints an error message and exits with one
240 of the following values:
241 .sp
242 .ne 2
243 .na
244 \fB\fB2\fR\fR
245 .ad
246 .sp .6
247 .RS 4n
248 The command syntax was invalid. A usage message for the \fBrolemod\fR command
249 is displayed.
250 .RE
252 .sp
253 .ne 2
254 .na
255 \fB\fB3\fR\fR
256 .ad
257 .sp .6
258 .RS 4n
259 An invalid argument was provided to an option.
260 .RE
262 .sp
263 .ne 2
264 .na
265 \fB\fB4\fR\fR
266 .ad
267 .sp .6
268 .RS 4n
269 The \fIuid\fR given with the \fB-u\fR option is already in use.
270 .RE
272 .sp
273 .ne 2
274 .na
275 \fB\fB5\fR\fR
276 .ad
277 .sp .6
278 .RS 4n
279 The password files contain an error. See \fBpasswd\fR(4).
280 .RE
282 .sp
283 .ne 2
284 .na
285 \fB\fB6\fR\fR
286 .ad
287 .sp .6
288 .RS 4n
289 The login to be modified does not exist, the \fIgroup\fR does not exist, or the
290 login shell does not exist.
291 .RE
293 .sp
294 .ne 2
295 .na
296 \fB\fB8\fR\fR
297 .ad
298 .sp .6
299 .RS 4n
300 The login to be modified is in use.
301 .RE
303 .sp
304 .ne 2
305 .na
306 \fB\fB9\fR\fR
307 .ad
308 .sp .6
309 .RS 4n
310 The \fInew_logname\fR is already in use.
311 .RE
313 .sp
314 .ne 2
315 .na
316 \fB\fB10\fR\fR
317 .ad
318 .sp .6
319 .RS 4n
320 Cannot update the \fB/etc/group\fR or \fB/etc/user_attr\fR file. Other update
321 requests will be implemented.
322 .RE
324 .sp
325 .ne 2
326 .na
327 \fB\fB11\fR\fR
328 .ad
329 .sp .6
330 .RS 4n
331 Insufficient space to move the home directory (\fB-m\fR option). Other update
332 requests will be implemented.
333 .RE
335 .sp
336 .ne 2
337 .na
338 \fB\fB12\fR\fR
339 .ad
340 .sp .6
341 .RS 4n
342 Unable to complete the move of the home directory to the new home directory.
343 .RE
345 .SH FILES
346 .sp
347 .ne 2
348 .na
349 \fB\fB/etc/group\fR\fR
350 .ad
351 .sp .6
352 .RS 4n
353 system file containing group definitions
354 .RE
356 .sp
357 .ne 2
358 .na
359 \fB\fB/etc/datemsk\fR\fR
360 .ad
361 .sp .6
362 .RS 4n
363 system file of date formats
364 .RE
366 .sp
367 .ne 2
368 .na
369 \fB\fB/etc/passwd\fR\fR
370 .ad
371 .sp .6
372 .RS 4n
373 system password file
374 .RE
376 .sp
377 .ne 2
378 .na
379 \fB\fB/etc/shadow\fR\fR
380 .ad
381 .sp .6
382 .RS 4n
383 system file containing users' and roles' encrypted passwords and related
384 information
385 .RE
387 .sp
388 .ne 2
389 .na
390 \fB\fB/etc/user_attr\fR\fR
391 .ad
392 .sp .6
393 .RS 4n
394 system file containing additional user and role attributes
395 .RE
397 .SH ATTRIBUTES
398 .sp
399 .LP
400 See \fBattributes\fR(5) for descriptions of the following attributes:
401 .sp
403 .sp
404 .TS
405 box;
406 c | c
407 l | l .
408 ATTRIBUTE TYPE ATTRIBUTE VALUE
409 _
410 Interface Stability Evolving
411 .TE
413 .SH SEE ALSO
414 .sp
415 .LP
416 \fBchown\fR(1), \fBpasswd\fR(1), \fBusers\fR(1B), \fBgroupadd\fR(8),
417 \fBgroupdel\fR(8), \fBgroupmod\fR(8), \fBlogins\fR(8),
418 \fBroleadd\fR(8), \fBroledel\fR(8), \fBuseradd\fR(8), \fBuserdel\fR(8),
419 \fBusermod\fR(8), \fBgetdate\fR(3C), \fBauth_attr\fR(4), \fBpasswd\fR(4),
420 \fBattributes\fR(5)