Wiki code for RBAC - Role Based Access Control

Hide Line numbers
1: == What is RBAC ?
2: 
3: Role-based access control allows system administrators to
4: delegate the administrative control of parts of the system to
5: users.  Users can be given the ability to run commands with
6: additional privilege in two ways.  Either by assigning a
7: profile directly to the user, in which case no additional
8: authentication is required.  Or by creating a role.
9: It can also be used to build restrictive environments for
10: users by removing their ability to run commands they would normally
11: be allowed to.
12: 
13: [[OpenSolaris UserGroup RBAC presenation>>attach:Community Group security.files@losug-security-rbac.pdf]]
14: 
15: == Why use RBAC vs sudo (for Solaris) 
16: (Note this may not apply to all OpenSolaris distributions)
17: 
18: ** RBAC is built into Solaris (since S8) and supported by Sun.
19: ** RBAC is documented, patched, updated and integrated throughout Solaris
20: ** RBAC is supported by the Solaris Management Console and WebMin GUI’s
21: ** RBAC is integrated with SMF in Solaris 10.
22: ** RBAC is evaluated along with the rest of the OS during Common
23:       Criteria evaluations.  Sudo is not included in the evaluation.
24: ** RBAC actions are audited by the same CC evaluated audit facility used through Solaris
25: ** RBAC offers roles as well as the pfexec command which provides a similar capability to sudo.
26: 
27: == Why use sudo rather than RBAC
28: 
29: * Cross platform
30: * Support for control of CLI arguments (see TODO list below)
31: * Support for setting per command environment (see TODO list below)
32: 
33: 
34: == What about sudo & privileges ?
35: 
36: Having sudo be privilege aware would be great for OpenSolaris as well.  This would probably be done by adding new keywords to the sudoers grammar so that you can specify the privileges that the command should run with.  It would be very cool if someone could implement this and contribute it back to the main sudo branch.
37: 
38: 
39: === RBAC Best Practices for OpenSolaris developers
40: 
41: The following best practice documents for using RBAC in developing
42: other parts of OpenSolaris can be found in the ARC community:
43: 
44: * [[When to use setuid vs RBAC roles>>Community Group arc.rbac-intro]]
45: 
46: * [[Adding New authorisations to OpenSolaris>>Community Group arc.rbac-auths]]
47: 
48: * [[Bulding RBAC Rights Profiles>>Community Group arc.rbac-profiles]]
49: 
50: === RBAC TODO List
51: 
52: The following is a list of mini projects or RFEs that we know
53: we need to implement in the OpenSolaris RBAC framework to get
54: parity with sudo or to fill a customer need.
55: 
56: Please help us out by implementing one of these:
57: 
58: * Control of environment variables: [[6227888>>http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6227888]]
59:   Ability to set and clear any environment variable for a specific
60:   entry in exec_attr(4). 
61: 
62: * Control of command line args: [[5097247>>http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=5097247]]
63:   Restrict which arguments to a command get the additional privilege,
64:   For example run passwd(1) but only with a user name not with any
65:   of the password aging options.
66: 
67: * Netgroups integration [[4986798>>http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=498679]]
68:   For all of the RBAC databases that make up a profile definition and
69:   assignment of it to a user (exec_attr, prof_attr, user_attr) control
70:   which hosts it is valid on using netgroups.  The currently unused
71:   "qualifier" field in user_attr(4) is intended for this as is one
72:   of the reserved fields in prof_attr(4).
73: 
74: 
75: == History of RBAC in Solaris
76: 
77: The main stream Solaris first got RBAC in Solaris 8.  In Solaris 9 new profiles were added but no new core functionality from the framework.   In Solaris 10 RBAC was integrated with least privilege, SMF and SMC.
78: 
79: Trusted Solaris (now replaced by [[Trusted Extensions>>Community Group security.tx]]) had an RBAC system in all of its releases going back to the SunOS 4.1.3 based versions.  The implementation was slighly different but the basic concepts are the same.
OpenSolaris

Top Menu

Wiki code for RBAC - Role Based Access Control

Search

Collectives

Community Group

Project

User Group

Subsites

Community Group security Pages
