prof_attr

 

---

 
 
 
 File Formats                                         prof_attr(4)
 
 
 


NAME
      prof_attr - profile description database
 


SYNOPSIS
      /etc/security/prof_attr
 


DESCRIPTION
      /etc/security/prof_attr is a local source for execution pro-
      file  names, descriptions, and other attributes of execution
      profiles. The prof_attr file can be used with other  profile
      sources,  including  the  prof_attr  NIS map and NIS+ table.
      Programs use the getprofattr(3SECDB) routines to gain access
      to this information.
 
      The search order for multiple prof_attr sources is specified
      in   the   /etc/nsswitch.conf  file,  as  described  in  the
      nsswitch.conf(4) man page.
 
      An execution profile is a mechanism used to bundle  together
      the  commands and authorizations needed to peform a specific
      function. Each entry in the prof_attr database  consists  of
      one  line of text containing five fields separated by colons
      (:). Line continuations using the  backslash  (\)  character
      are permitted. The format of each entry is:
 
           profname:res1:res2:desc:attr
 
 
      profname
            The name of  the  profile.  Profile  names  are  case-
            sensitive.
 
      res1  Reserved for future use.
 
      res2  Reserved for future use.
 
      desc  A long description. This field should explain the pur-
            pose of the profile, including what type of user would
            be interested in using it. The long description should
            be  suitable  for  displaying  in  the help text of an
            application.
 
      attr  An optional list of semicolon-separated (;)  key-value
            pairs  that  describe the security attributes to apply
            to the object upon execution. Zero or more keys may be
            specified. There are two valid keys, help and auths.
 
            help is assigned the name of a file ending in .htm  or
            .html.
 
            auths specifies a comma-separated (,) list of authori-
            zation  names  chosen  from those names defined in the
 
 
 
 SunOS 5.8           Last change: 26 Oct 1999                    1
 
 
 
 
 
 
 File Formats                                         prof_attr(4)
 
 
 
            auth_attr(4)  database.  Authorization  names  may  be
            specified  using the asterisk (*) character as a wild-
            card. For example, solaris.printer.* would mean all of
            Sun's authorizations for printing.
 
 EXAMPLES
      Example 1: Allowing execution of all commands
 
      The following entry allows the user to execute all commands:
 
      All:::Use this profile to give a :help=All.html
 
      Example 2: Consulting the local prof_attr file first
 
      With the following nsswitch.conf entry, the local  prof_attr
      file is consulted before the NIS+ table:
 
      prof_attr: files nisplus
 


FILES
      /etc/nsswitch.conf"
 
      /etc/security/prof_attr
 


NOTES
      When  deciding  which  authorization  source  to  use   (see
      DESCRIPTION),  keep  in  mind  that  NIS+  provides stronger
      authentication than NIS.
 
      The root user is usually defined in local databases  because
      root needs to be able to log in and do system maintenance in
      single-user mode and at other times when  the  network  name
      service  databases  are  not  available. So that the profile
      definitions for root can be located at  such  times,  root's
      profiles  should be defined in the local prof_attr file, and
      the order shown in the example  nsswitch.conf(4) file  entry
      under EXAMPLES is highly recommended.
 
      Because the list of legal keys is likely to expand, any code
      that  parses this database must be written to ignore unknown
      key-value pairs without error. When  any  new  keywords  are
      created,  the names should be prefixed with a unique string,
      such as the company's stock symbol, to avoid potential  nam-
      ing conflicts.
 
      Each application has its own requirements  for  whether  the
      help  value  must  be  a  relative  pathname  ending  with a
      filename or the name of a file. The only  known  requirement
      is for the name of a file.
 
      The following characters are used in describing the database
      format and must be escaped with a backslash if used as data:
 
 
 
 SunOS 5.8           Last change: 26 Oct 1999                    2
 
 
 
 
 
 
 File Formats                                         prof_attr(4)
 
 
 
      colon (:), semicolon (;), equals (=), and backslash (\).
 


SEE ALSO
      auths(1),         profiles(1),          getauthattr(3SECDB),
      getprofattr(3SECDB),    getuserattr(3SECDB),   auth_attr(4),
      exec_attr(4), user_attr(4)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 SunOS 5.8           Last change: 26 Oct 1999                    3
 
 
 

---