How role in RBAC works ?

Below is the output from my /etc/security/exec_attr, here I have assign /usr/sbin/poweroff and /usr/sbin/reboot command to 'shutdown' profile and later assigned 'shutdown' profile to a role named 'power'

so now I assigned 'power' role to a user 'user1' so doesn't it mean whenever 'user1' assume the 'power' role he should be able to run only /usr/sbin/poweroff and /usr/sbin/reboot command. no other command like 'ls' 'cp' 'mv'. ? please let me me know if I am getting it right.

Open in new window

Who is Participating?
Brian UtterbackConnect With a Mentor Principle Software EngineerCommented:
No. Assuming a role does not take away the normal privileges, so all the commands will work as they always do. It just means that in addition to the normal ones, the role user can run the commands designated in exec_attr with the specified attributes, in this case running the poweroff and reboot commands as uid=0.  

In fact, if you assign the role to a user, that user does not even have to assume the role to execute the commands. He can just use the pfexec command (kind of like sudo) and it will run with the exec_attr attributes.

If you do not assign the role, then the users will assume the role using the su command.

By the way, in general you shouldn't be using reboot. The reboot command is an emergency command, one step above
the halt command. It bypasses all of the normal shutdown processing. You should be using either the shutdown command or the init command.
yuzhConnect With a Mentor Commented:
addtion to blu's comment.
Roles are similar to regular system users, however roles may not log into the system. The preferred method of assuming a role is to use the `su` command.  
also please have a look at the following docs to learn more details:
beer9Author Commented:
Thanks! :-)
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.