'\" te
.\"  Copyright (c) 2008, Sun Microsystems, Inc. All rights reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH PROF_ATTR 4 "Apr 3, 2008"
.SH NAME
prof_attr \- profile description database
.SH SYNOPSIS
.LP
.nf
\fB/etc/security/prof_attr\fR
.fi

.SH DESCRIPTION
.sp
.LP
\fB/etc/security/prof_attr\fR is a local source for execution profile names,
descriptions, and other attributes of execution profiles. The \fBprof_attr\fR
file can be used with other profile sources, including the \fBprof_attr\fR
\fBNIS\fR map and \fBNIS+\fR table. Programs use the \fBgetprofattr\fR(3SECDB)
routines to gain access to this information.
.sp
.LP
The search order for multiple \fBprof_attr\fR sources is specified in the
\fB/etc/nsswitch.conf\fR file, as described in the \fBnsswitch.conf\fR(4) man
page.
.sp
.LP
An execution profile is a mechanism used to bundle together the commands and
authorizations needed to perform a specific function. An execution profile can
also contain other execution profiles. Each entry in the \fBprof_attr\fR
database consists of one line of text containing five fields separated by
colons (\fB:\fR). Line continuations using the backslash (\fB\e\fR) character
are permitted. The format of each entry is:
.sp
.LP
\fIprofname\fR:\fIres1\fR:\fIres2\fR:\fIdesc\fR:\fIattr\fR
.sp
.ne 2
.na
\fB\fIprofname\fR\fR
.ad
.RS 12n
The name of the profile. Profile names are case-sensitive.
.RE

.sp
.ne 2
.na
\fB\fIres1\fR\fR
.ad
.RS 12n
Reserved for future use.
.RE

.sp
.ne 2
.na
\fB\fIres2\fR\fR
.ad
.RS 12n
Reserved for future use.
.RE

.sp
.ne 2
.na
\fB\fIdesc\fR\fR
.ad
.RS 12n
A long description. This field should explain the purpose of the profile,
including what type of user would be interested in using it. The long
description should be suitable for displaying in the help text of an
application.
.RE

.sp
.ne 2
.na
\fB\fIattr\fR\fR
.ad
.RS 12n
An optional list of semicolon-separated (\fB;\fR) key-value pairs that describe
the security attributes to apply to the object upon execution. Zero or more
keys can be specified. There are four valid keys: \fBhelp\fR, \fBprofiles\fR,
\fBauths\fR, and \fBprivs\fR.
.sp
\fBhelp\fR is assigned the name of a file ending in \fB\&.htm\fR or
\fB\&.html\fR.
.sp
\fBauths\fR specifies a comma-separated list of authorization names chosen from
those names defined in the \fBauth_attr\fR(4) database. Authorization names can
be specified using the asterisk (\fB*\fR) character as a wildcard. For example,
\fBsolaris.printer.*\fR would mean all of Sun's authorizations for printing.
.sp
\fBprofiles\fR specifies a comma-separated list of profile names chosen from
those names defined in the \fBprof_attr\fR database.
.sp
\fBprivs\fR specifies a comma-separated list of privileges names chosen from
those names defined in the \fBpriv_names\fR(4) database. These privileges can
then be used for executing commands with \fBpfexec\fR(1).
.RE

.SH EXAMPLES
.LP
\fBExample 1 \fRAllowing Execution of All Commands
.sp
.LP
The following entry allows the user to execute all commands:

.sp
.in +2
.nf
\fBAll:::Use this profile to give a :help=All.html\fR
.fi
.in -2
.sp

.LP
\fBExample 2 \fRConsulting the Local \fBprof_attr\fR File First
.sp
.LP
With the following \fBnsswitch.conf\fR entry, the local \fBprof_attr\fR file is
consulted before the \fBNIS+\fR table:

.sp
.in +2
.nf
\fBprof_attr: files nisplus\fR
.fi
.in -2
.sp

.SH FILES
.sp
.LP
\fB/etc/nsswitch.conf\fR
.sp
.LP
\fB/etc/security/prof_attr\fR
.SH NOTES
.sp
.LP
When deciding which authorization source to use (see \fBDESCRIPTION\fR), keep
in mind that \fBNIS+\fR provides stronger authentication than \fBNIS\fR.
.sp
.LP
The root user is usually defined in local databases because root needs to be
able to log in and do system maintenance in single-user mode and at other times
when the network name service databases are not available. So that the profile
definitions for root can be located at such times, root's profiles should be
defined in the local \fBprof_attr\fR file, and the order shown in the example
\fBnsswitch.conf\fR(4) file entry under EXAMPLES is highly recommended.
.sp
.LP
Because the list of legal keys is likely to expand, any code that parses this
database must be written to ignore unknown key-value pairs without error. When
any new keywords are created, the names should be prefixed with a unique
string, such as the company's stock symbol, to avoid potential naming
conflicts.
.sp
.LP
Each application has its own requirements for whether the \fBhelp\fR value must
be a relative pathname ending with a filename or the name of a file. The only
known requirement is for the name of a file.
.sp
.LP
The following characters are used in describing the database format and must be
escaped with a backslash if used as data: colon (\fB:\fR), semicolon (\fB;\fR),
equals (\fB=\fR), and backslash (\fB\e\fR).
.SH SEE ALSO
.sp
.LP
\fBauths\fR(1), \fBpfexec\fR(1), \fBprofiles\fR(1), \fBgetauthattr\fR(3SECDB),
\fBgetprofattr\fR(3SECDB), \fBgetuserattr\fR(3SECDB), \fBauth_attr\fR(4),
\fBexec_attr\fR(4), \fBpriv_names\fR(4), \fBuser_attr\fR(4)