Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
Copyright (C) 2008 Sun Microsystems, Inc. All Rights Reserved
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
/etc/user_attr
The search order for multiple user_attr sources is specified in the /etc/nsswitch.conf file, as described in the nsswitch.conf(5) man page. The search order follows that for passwd(5).
Each entry in the user_attr databases consists of a single line with five fields separated by colons (:). Line continuations using the backslash (\e) character are permitted. Each entry has the form:
user:qualifier:res1:res2:attruser
The name of the user as specified in the passwd(5) database.
Reserved for future use.
Reserved for future use.
Reserved for future use.
An optional list of semicolon-separated (;) key-value pairs that describe the security attributes to apply to the object upon execution. Zero or more keys may be specified. The following keys are currently interpreted by the system: auths
Specifies a comma-separated list of authorization names chosen from those names defined in the auth_attr(5) database. Authorization names may be specified using the asterisk (*) character as a wildcard. For example, solaris.printer.* means all of Sun's printer authorizations.
Contains an ordered, comma-separated list of profile names chosen from prof_attr(5). Profiles are enforced by the profile shells, pfcsh, pfksh, and pfsh. See pfsh(1). A default profile is assigned in /etc/security/policy.conf (see policy.conf(5)). If no profiles are assigned, the profile shells do not allow the user to execute any commands.
Specifies whether a user assuming a role is required to use the role password or their own password. If the roleauth key value is not specified, the role password is required for users assuming the role.
Can be assigned a comma-separated list of role names from the set of user accounts in this database whose type field indicates the account is a role. If the roles key value is not specified, the user is not permitted to assume any role.
Can be assigned one of these strings: normal, indicating that this account is for a normal user, one who logs in; or role, indicating that this account is for a role. Roles can only be assumed by a normal user after the user has logged in.
Can be assigned a name of one project from the project(5) database to be used as a default project to place the user in at login time. For more information, see getdefaultproj(3PROJECT).
The default set of privileges assigned to a user's inheritable set upon login. See "Privileges Keywords," below.
The maximum set of privileges a user or any process started by the user, whether through su(8) or any other means, can obtain. The system administrator must take extreme care when removing privileges from the limit set. Removing any basic privilege has the ability of crippling all applications; removing any other privilege can cause many or all applications requiring privileges to malfunction. See "Privileges Keywords," below.
Specifies whether an account is locked after the count of failed logins for a user equals or exceeds the allowed number of retries as defined by RETRIES in /etc/default/login. Possible values are yes or no. The default is no. Account locking is applicable only to local accounts.
Contains the maximum label at which the user can operate. If unspecified, in the Defense Intelligence Agency (DIA) encodings scheme, the default is specified in label_encodings(5) (see label_encodings(5) and labels(7) in the Solaris Trusted Extensions Reference Manual).
Contains the minimum label at which the user can log in. If unspecified, in the DIA encodings scheme, the default is specified in label_encodings(5) (see label_encodings(5) and labels(7) in the Solaris Trusted Extensions Reference Manual).
Except for the type key, the key=value fields in /etc/user_attr can be added using roleadd(8) and useradd(8). You can use rolemod(8) and usermod(8) to modify key=value fields in /etc/user_attr. Modification of the type key is restricted as described in rolemod and usermod.
See privileges(7) for a description of privileges. The command ppriv -l (see ppriv(1)) produces a list of all supported privileges. Note that you specify privileges as they are displayed by ppriv. In privileges(7), privileges are listed in the form PRIV_<privilege_name>. For example, the privilege file_chown, as you would specify it in user_attr, is listed in privileges(7) as PRIV_FILE_CHOWN.
See usermod(8) for examples of commands that modify privileges and their subsequent effect on user_attr.
The following example entry assigns to root the All profile, which allows root to use all commands in the system, and also assigns two authorizations:
root::::auths=solaris.*,solaris.grant;profiles=All;type=normal
The solaris.* wildcard authorization shown above gives root all the solaris authorizations; and the solaris.grant authorization gives root the right to grant to others any solaris authorizations that root has. The combination of authorizations enables root to grant to others all the solaris authorizations. See auth_attr(5) for more about authorizations.
See nsswitch.conf(5).
Described here.
| ATTRIBUTE TYPE ATTRIBUTE VALUE |
| Availibility SUNWcsr |
| Interface Stability See below |
The command-line syntax is Committed. The output is Uncommitted.
System Administration Guide: Security Services
Because the list of legal keys is likely to expand, any code that parses this database must be written to ignore unknown key-value pairs without error. When any new keywords are created, the names should be prefixed with a unique string, such as the company's stock symbol, to avoid potential naming conflicts.
In the attr field, escape the following symbols with a backslash (\e) if you use them in any value: colon (:), semicolon (;), carriage return (\en), equals (=), or backslash (\e).