Wiki code for Building RBAC Rights Profiles

Hide Line numbers
1: ==  Building RBAC Rights Profiles
2: 
3: Copyright 2006, Sun Microsystems, Inc
4: 
5: ||**Table of Contents**|**Overview**|**BestPractice Synopsis**
6: |
7: [[Advice>>#Advice]]
8: [[CaseHistory>>#CaseHistory]]
9: [[References>>#References]]
10: ||Category|Software.RBAC
11: |Owner|SAC
12: |Author|Gary Winiger
13: |Changes|[[Gary.Winiger@Sun.COM>>mailto:Gary.Winiger@Sun.COM]]
14: |Authority|SAC
15: |Policy Version|1.0
16: |Status|DRAFT 2006/01/16
17: |Effective|Solaris 2.10
18: | HOWTO guide for adding RBAC Rights Profiles
19: | |
20: ----
21: == Advice
22: You might need to build a Rights Profile from scratch if there is not already one that seems appropriate. First check the current ON gate .../usr/src/lib/libsecdb/prof_attr.txt prof_attr(4) contains the names of the current Rights Profiles, see the short description and the contents of the matching .../usr/src/lib/libsecdb/exec_attr.txt (exec_attr(4)) entries to see if it is a match for your needs. If it is, your can add to it. Generally you would not add authorizations to existing Rights Profiles unless you are adding authorizations in the same family. I.e., if new Audit authorizations are added to solaris.audit.*, then they would be candidates to add to the "Audit Control" profile. See http://sac.eng/cgi-bin/bp.cgi?NAME=RBAC.bp for guidance about suid programs and authorizations.
23:  Authorizations should be assigned to Rights Profiles in prof_attr(4) an auths= list and the Rights Profile assigned to a user via the profs= list in user_attr(4), rather than the obsolete use of auths= in user_attr(4). If you need to build a Rights Profile from scratch, here’s a suggestion on how to proceed.
24: === Adding a new Rights Profile which contains commands to ON
25: *1. Pick a Rights Profile Name that doesn’t conflict with a current name. Note there is more than one place that profiles are found. ON profiles are in {{code}}..../usr/src/lib/libsecdb/prof_attr.txt{{/code}}. Be aware that other gates may also deliver prof_attr entries. In the admin gate profiles are in
26: {{code}}.../src/bundled/app/drm/rbac/security/prof_attr{{/code}}
27: {{code}}.../src/bundled/app/wbem/solaris/rbac/security/prof_attr{{/code}}
28: {{code}}.../src/bundled/app/webmgt/webconsole/conf/prof_attr{{/code}}
29:  The the CDE gate profiles are in
30: {{code}}.../cdesrc/cde1/rbac/security/prof_attr{{/code}}
31:  For this example, name the Rights Profile "Xx Yy Zz"
32: *1. Add a line (alphabetically would be nice ;-) to prof_attr that reads:
33: {{code}}Xx Yy Zz:::Short Description:help=RtXxYyZz.html{{/code}}
34: *1. For Solaris 10 and later releases, for each CLI in the Rights Profile add to {{code}}.../lib/libsecdb/exec_attr{{/code}} line(s) that read:
35: {{code}} Xx Yy Zz:solaris:cmd:::<full path to command>:<attributes>{{/code}}
36:  such that the <attributes> take on the least privileged values needed to do the function, choose from privs=<privilege set>, limitprivs=<privilege set>, euid=<uid>, egid=<gid>, uid=<uid>, gid=<gid> (see privileges(5), exec_attr(4)).
37:  For systems prior to Solaris 10 only, for each CLI in the Rights Profile add to {{code}}.../lib/libsecdb/exec_attr{{/code}} line(s) that read:
38: {{code}}Xx Yy Zz:suser:cmd:::<full path to command>:<attributes>{{/code}}
39:  such that the <attributes> take on the least privileged value needed to do the function, choose from euid=<uid>, egid=<gid>, uid=<uid>, gid=<gid> (see exec_attr(4)).
40: *1. Create a simple HTML help file in .../lib/libsecdb/help/profiles. The file name for this example is RtXxYyZz.html. Update the Makefile. Use an existing help file for the HTML syntax and describe help for the profile that you’ve just created.
41: *1. Update the help file packages SUNWcsu, SUNW0on. in SUNWcsu/prototype_com
42: {{code}}f none usr/lib/help/profiles/locale/C/RtXxYyZz.html 444 root bin{{/code}}
43:  in SUNW0on/prototype_com
44: {{code}}f none usr/lib/help/profiles/locale/RtXxYyZz.html 444 root bin{{/code}}
45:  N.B. The difference between the paths ("C" -vs- none).
46: === Adding commands to an existing Rights Profile to ON:
47: *1. Pick an existing Rights Profile which matches the commands to be added. For this example call it "Xx Yy Zz"
48: *1. For Solaris 10 and later releases, for each CLI in the Rights Profile add to {{code}}.../lib/libsecdb/exec_attr{{/code}} line(s) that read:
49: {{code}} Xx Yy Zz:solaris:cmd:::<full path to command>:<attributes>{{/code}}
50:  such that the <attributes> take on the least privileged values needed to do the function, choose from privs=<privilege set>, limitprivs=<privilege set>, euid=<uid>, egid=<gid>, uid=<uid>, gid=<gid> (see privileges(5), exec_attr(4)).
51:  For systems prior to Solaris 10 only, for each CLI in the Rights Profile add to {{code}}.../lib/libsecdb/exec_attr{{/code}} line(s) that read:
52: {{code}}Xx Yy Zz:suser:cmd:::<full path to command>:<attributes>{{/code}}
53:  such that the <attributes> take on the least privileged value needed to do the function, choose from euid=<uid>, egid=<gid>, uid=<uid>, gid=<gid> (see exec_attr(4)).
54: === Adding a new Rights Profile to other gates
55: *1. Do pretty much the same steps with local sources for prof_attr and exec_attr.
56:  If this is the first Rights Profile for this gate, the prof_attr and exec_attr files should use the rbac class action script and deliver into {{code}}/etc/security/{prof,exec}_attr{{/code}}. I.e., in prototype_com:
57: {{code}}e rbac etc/security/prof_attr 644 root sys{{/code}}
58:  HTML help files should be delivered by the ``usr’’ and ``globalization’’ (G11N) packages (as equivalent to SUNWcsu, SUNW0on)
59:  in SUNW``usr’’/prototype_com
60: {{code}}f none usr/lib/help/profiles/locale/C/RtXxYyZz.html 444 root bin{{/code}}
61:  in SUNW0``G11N’’/prototype_com
62: {{code}}f none usr/lib/help/profiles/locale/C/RtXxYyZz.html 444 root bin{{/code}}
63: ----
64: == CaseHistory
65: |=Case|=Type|=Name
66: |[[PSARC/1997/332>>Community Group arc.332]]|OnePager|Execution Profiles for Restricted Environments  
67: |[[PSARC/2002/188>>Community Group arc.188]]|OnePager|Least Privilege for Solaris  
68: ----
69: == References
70: [[ RBAC in the Solaris[tm] Operating Environment - White Paper>>http://www.sun.com/software/whitepapers/wp-rbac/wp-rbac.pdf]]
71: [[ Authorization Infrastructure in Solaris - Developer Connection>>http://soldc.sun.com/articles/ais.html]]
72: |
OpenSolaris

Top Menu

Wiki code for Building RBAC Rights Profiles

Search

Collectives

Community Group

Project

User Group

Subsites

Community Group arc Pages
