Avatar of beer9
beer9Flag for India asked on

How to add auth RBAC to a user in Solaris 10 ?

I want to add a user with 'shutting down/poweroff' authorization RBAC. I got this entry in /etc/secutiry/auth_attr

bash-3.00# grep shutdown /etc/security/auth_attr
solaris.system.shutdown:::Shutdown the System::help=SysShutdown.html



I did 'usermod -A solaris.system.shutdown username

but still I am not able to poweroff the system using command /usr/sbin/poweroff
I am getting permission denied error.

Kindly suggest how can I use the predefined auth.
Unix OS

Avatar of undefined
Last Comment
beer9

8/22/2022 - Mon
yuzh

ASKER
beer9

I am getting problem to understand this concept specially the 'auth' part.
We already have system defined authorization like solaris.system.shutdown in /etc/security/auth_attr

but still I had to manually define a profile which auth the profile in /etc/security/prof_attr and later defined a associated command like /usr/sbin/poweroff in /etc/security/exec_attr for the named profile.

and after doing all this, I created a new role and with just defined profile and assigned to a user. and then I got the expected result


My whole concern is why we have predefined authorization, and how to use that in simple way.
I just noticed we too have '-A (authorization)' option in useradd comamnd, how can I simply allow a user to assign specific authorization.
ASKER
beer9

also my another curiosity is how can I find out which(how many) commands are associated with auth 'solaris.jobs.admin'
I just guess that 'contab' should be working but is there way I can get a list of command which support auth 'solaris.jobs.admin' ??
Your help has saved me hundreds of hours of internet surfing.
fblack61
joules17

try this command
usermod -u UID -R rolename

to put the changes into effect
svcadm restart system/name-service-cache
ASKER
beer9

I am getting problem to understand the 'auth' in RBAC, please let me know if some example satisfy my curiosity.
ASKER CERTIFIED SOLUTION
yuzh

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
beer9

Thank you! :)
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.