Tribblix: manual page: prof

PROF_ATTR(5) File Formats and Configurations PROF_ATTR(5)

NAME

prof_attr - profile description database

SYNOPSIS

/etc/security/prof_attr

DESCRIPTION

/etc/security/prof_attr is a local source for execution profile
names, descriptions, and other attributes of execution profiles. The
prof_attr file can be used with other profile sources, including the
prof_attr NIS map. Programs use the getprofattr(3SECDB) routines to
gain access to this information.

The search order for multiple prof_attr sources is specified in the
/etc/nsswitch.conf file, as described in the nsswitch.conf(5) man
page.

An execution profile is a mechanism used to bundle together the
commands and authorizations needed to perform a specific function. An
execution profile can also contain other execution profiles. Each
entry in the prof_attr database consists of one line of text
containing five fields separated by colons (:). Line continuations
using the backslash (\) character are permitted. The format of each
entry is:

profname:res1:res2:desc:attr

profname
The name of the profile. Profile names are case-
sensitive.

res1
Reserved for future use.

res2
Reserved for future use.

desc
A long description. This field should explain the purpose
of the profile, including what type of user would be
interested in using it. The long description should be
suitable for displaying in the help text of an
application.

attr
An optional list of semicolon-separated (;) key-value
pairs that describe the security attributes to apply to
the object upon execution. Zero or more keys can be
specified. There are four valid keys: help, profiles,
auths, and privs.

help is assigned the name of a file ending in .htm or
.html.

auths specifies a comma-separated list of authorization
names chosen from those names defined in the auth_attr(5)
database. Authorization names can be specified using the
asterisk (*) character as a wildcard. For example,
solaris.printer.* would mean all of Sun's authorizations
for printing.

profiles specifies a comma-separated list of profile
names chosen from those names defined in the prof_attr
database.

privs specifies a comma-separated list of privileges
names chosen from those names defined in the
priv_names(5) database. These privileges can then be used
for executing commands with pfexec(1).

EXAMPLES

Example 1: Allowing Execution of All Commands

The following entry allows the user to execute all commands:

All:::Use this profile to give a :help=All.html

Example 2: Consulting the Local prof_attr File First

With the following nsswitch.conf entry, the local prof_attr file is
consulted before the NIS map:

prof_attr: files nis

FILES

/etc/nsswitch.conf

/etc/security/prof_attr

NOTES

The root user is usually defined in local databases because root
needs to be able to log in and do system maintenance in single-user
mode and at other times when the network name service databases are
not available. So that the profile definitions for root can be
located at such times, root's profiles should be defined in the local
prof_attr file, and the order shown in the example nsswitch.conf(5)
file entry under EXAMPLES is highly recommended.

Because the list of legal keys is likely to expand, any code that
parses this database must be written to ignore unknown key-value
pairs without error. When any new keywords are created, the names
should be prefixed with a unique string, such as the company's stock
symbol, to avoid potential naming conflicts.

Each application has its own requirements for whether the help value
must be a relative pathname ending with a filename or the name of a
file. The only known requirement is for the name of a file.

The following characters are used in describing the database format
and must be escaped with a backslash if used as data: colon (:),
semicolon (;), equals (=), and backslash (\).