174b5a35dSPaul Cheng# 274b5a35dSPaul Cheng# CDDL HEADER START 374b5a35dSPaul Cheng# 474b5a35dSPaul Cheng# The contents of this file are subject to the terms of the 574b5a35dSPaul Cheng# Common Development and Distribution License (the "License"). 674b5a35dSPaul Cheng# You may not use this file except in compliance with the License. 774b5a35dSPaul Cheng# 874b5a35dSPaul Cheng# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 974b5a35dSPaul Cheng# or http://www.opensolaris.org/os/licensing. 1074b5a35dSPaul Cheng# See the License for the specific language governing permissions 1174b5a35dSPaul Cheng# and limitations under the License. 1274b5a35dSPaul Cheng# 1374b5a35dSPaul Cheng# When distributing Covered Code, include this CDDL HEADER in each 1474b5a35dSPaul Cheng# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 1574b5a35dSPaul Cheng# If applicable, add the following below this CDDL HEADER, with the 1674b5a35dSPaul Cheng# fields enclosed by brackets "[]" replaced with your own identifying 1774b5a35dSPaul Cheng# information: Portions Copyright [yyyy] [name of copyright owner] 1874b5a35dSPaul Cheng# 1974b5a35dSPaul Cheng# CDDL HEADER END 2074b5a35dSPaul Cheng# 2174b5a35dSPaul Cheng 220a925b19SPaul Cheng# Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved. 23a532f31bSgbrunett 247c478bd9Sstevel@tonic-gate# 257c478bd9Sstevel@tonic-gate# /etc/security/prof_attr 267c478bd9Sstevel@tonic-gate# 27*bbf21555SRichard Lowe# profiles attributes. see prof_attr(5) 287c478bd9Sstevel@tonic-gate# 297c478bd9Sstevel@tonic-gateAll:::Execute any command as the user or role:help=RtAll.html 30f8994074SJan FriedelAudit Configuration:::Configure Solaris Audit:auths=solaris.smf.value.audit;help=RtAuditCfg.html 31f8994074SJan FriedelAudit Control:::Control Solaris Audit:auths=solaris.smf.manage.audit;help=RtAuditCtrl.html 32f8994074SJan FriedelAudit Review:::Review Solaris Auditing logs:help=RtAuditReview.html 336ba597c5SAnurag S. MaskeyConsole User:::Manage System as the Console User:profiles=Suspend To RAM,Suspend To Disk,Brightness,CPU Power Management,Network Autoconf User;auths=solaris.system.shutdown;help=RtConsUser.html 347c478bd9Sstevel@tonic-gateContract Observer:::Reliably observe any/all contract events:help=RtContractObserver.html 357c478bd9Sstevel@tonic-gateDevice Management:::Control Access to Removable Media:auths=solaris.device.*;help=RtDeviceMngmnt.html 364e9cfc9aSjacobsPrinter Management:::Manage printers, daemons, spooling:auths=solaris.print.*,solaris.label.print,solaris.smf.manage.discovery.printers.*,solaris.smf.value.discovery.printers.*;help=RtPrntAdmin.html 377c478bd9Sstevel@tonic-gateCron Management:::Manage at and cron jobs:auths=solaris.jobs.*,solaris.smf.manage.cron;help=RtCronMngmnt.html 387c478bd9Sstevel@tonic-gateLog Management:::Manage log files:help=RtLogMngmnt.html 39ff0e937bSRaymond ChenBasic Solaris User:::Automatically assigned rights:auths=solaris.profmgr.read,solaris.mail.mailq,solaris.device.mount.removable,solaris.admin.wusb.read;profiles=All;help=RtDefault.html 40269f47deSThuy FettigDevice Security:::Manage devices and Volume Manager:auths=solaris.device.*,solaris.smf.manage.vt,solaris.smf.manage.allocate;help=RtDeviceSecurity.html 417c478bd9Sstevel@tonic-gateDHCP Management:::Manage the DHCP service:auths=solaris.dhcpmgr.*;help=RtDHCPMngmnt.html 42074e084fSmlExtended Accounting Flow Management:::Manage the Flow Extended Accounting service:auths=solaris.smf.manage.extended-accounting.flow,solaris.smf.value.extended-accounting.flow;profiles=acctadm;help=RtExActtFlow.html 43074e084fSmlExtended Accounting Process Management:::Manage the Process Extended Accounting service:auths=solaris.smf.manage.extended-accounting.process,solaris.smf.value.extended-accounting.process;profiles=acctadm;hep=RtExAcctProcess.html 44074e084fSmlExtended Accounting Task Management:::Manage the Task Extended Accounting service:auths=solaris.smf.manage.extended-accounting.task,solaris.smf.value.extended-accounting.task;profiles=acctadm;help=RtExAcctTask.html 45da14cebeSEric ChengExtended Accounting Net Management:::Manage the Net Extended Accounting service:auths=solaris.smf.manage.extended-accounting.net,solaris.smf.value.extended-accounting.net;profiles=acctadm;help=RtExActtNet.html 464bff34e3SthurlowFile System Management:::Manage, mount, share file systems:profiles=SMB Management,VSCAN Management,SMBFS Management;auths=solaris.smf.manage.autofs,solaris.smf.manage.shares.*,solaris.smf.value.shares.*;help=RtFileSysMngmnt.html 477c478bd9Sstevel@tonic-gateFile System Security:::Manage file system security attributes:help=RtFileSysSecurity.html 48134a1f4eSCasper H.S. DikForced Privilege:::Commands with forced privileges associated with them:help=RtReservedProfile.html 4918c2aff7SartemHAL Management:::Manage HAL SMF service:auths=solaris.smf.manage.hal;help=RtHALMngmnt.html 5026947304SEvan YanHotplug Management:::Manage Hotplug Connections:auths=solaris.smf.manage.hotplug,solaris.hotplug.*;help=RtHotplugMgmt.html 51fff9db26SvpIdmap Name Mapping Management:::Manage Name-based Mapping Rules of Identity Mapping Service:auths=solaris.admin.idmap.rules;help=RtIdmapNameRulesMngmnt.html 52fff9db26SvpIdmap Service Management:::Manage Identity Mapping Service:auths=solaris.smf.manage.idmap,solaris.smf.value.idmap;help=RtIdmapMngmnt.html 53fff9db26SvpInetd Management:::Manage inetd configuration parameters:auths=solaris.smf.manage.inetd,solaris.smf.value.inetd;help=RtInetdMngmnt.html 547c478bd9Sstevel@tonic-gateMail Management:::Manage sendmail & queues:auths=solaris.smf.manage.sendmail;help=RtMailMngmnt.html 5526947304SEvan YanMaintenance and Repair:::Maintain and repair a system:auths=solaris.smf.manage.system-log,solaris.label.range,solaris.smf.manage.coreadm,solaris.smf.value.coreadm;profiles=Hotplug Management;help=RtMaintAndRepair.html 5669987563SsabdarMedia Backup:::Backup files and file systems:profiles=NDMP Management;help=RtMediaBkup.html 57a2721256SWilliam YoungMedia Catalog:::Catalog files and file systems:help=RtMediaCtlg.html 5869987563SsabdarMedia Restore:::Restore files and file systems from backups:profiles=NDMP Management;help=RtMediaRestore.html 5969987563SsabdarNDMP Management:::Manage the NDMP service:auths=solaris.smf.manage.ndmp,solaris.smf.value.ndmp,solaris.smf.read.ndmp;help=RtNdmpMngmnt.html 606ba597c5SAnurag S. MaskeyNetwork Autoconf Admin:::Manage Network Auto-Magic configuration via nwamd:profiles=Network Autoconf User;auths=solaris.network.autoconf.write,solaris.smf.manage.location,solaris.smf.modify.application;help=RtNetAutoconfAdmin.html 616ba597c5SAnurag S. MaskeyNetwork Autoconf User:::Network Auto-Magic User:auths=solaris.network.autoconf.read,solaris.network.autoconf.select,solaris.network.autoconf.wlan;help=RtNetAutoconfUser.html 62dbed73cbSSangeeta MisraNetwork ILB:::Manage ILB configuration via ilbadm:auths=solaris.network.ilb.config,solaris.network.ilb.enable;help=RtNetILB.html 63c5e0ece0SCathy ZhouNetwork VRRP:::Manage VRRP instances:auths=solaris.network.vrrp,solaris.smf.manage.vrrp;help=RtNetVRRP.html 646e91bba0SGirish MoodalbailNetwork Management:::Manage the host and network configuration:auths=solaris.smf.manage.name-service-cache,solaris.smf.manage.bind,solaris.smf.value.routing,solaris.smf.manage.routing,solaris.smf.value.nwam,solaris.smf.manage.nwam,solaris.smf.manage.tnd,solaris.smf.manage.tnctl,solaris.smf.manage.wpa,solaris.smf.value.mdns,solaris.smf.manage.mdns,solaris.smf.manage.ilb,solaris.network.interface.config;profiles=Network Wifi Management,Inetd Management,Network VRRP,Network Observability;help=RtNetMngmnt.html 65b127ac41SPhilip KirkNetwork Observability:::Allow access to observability devices:privs=net_observability;help=RtNetObservability.html 66ead1f93eSLiane PrazaNetwork Security:::Manage network and host security:auths=solaris.smf.manage.ssh,solaris.smf.value.tnd,solaris.network.*;profiles=Network Wifi Security,Network Link Security,Network IPsec Management;help=RtNetSecure.html 67516fc7f3ShxNetwork Wifi Management:::Manage wifi network configuration:auths=solaris.network.wifi.config;help=RtNetWifiMngmnt.html 68516fc7f3ShxNetwork Wifi Security:::Manage wifi network security:auths=solaris.network.wifi.wep;help=RtNetWifiSecure.html 690ba2cbe9SxcNetwork Link Security:::Manage network link security:auths=solaris.network.link.security;help=RtNetLinkSecure.html 70e3320f40SmarkfenNetwork IPsec Management:::Manage IPsec and IKE:auths=solaris.smf.manage.ipsec,solaris.smf.value.ipsec;help=RtNetIPsec.html 717c478bd9Sstevel@tonic-gateName Service Management:::Non-security name service scripts/commands:help=RtNameServiceAdmin.html 727c478bd9Sstevel@tonic-gateName Service Security:::Security related name service scripts/commands:help=RtNameServiceSecure.html 737c478bd9Sstevel@tonic-gateObject Access Management:::Change ownership and permission on files:help=RtObAccessMngmnt.html 74ead1f93eSLiane PrazaOperator:::Can perform simple administrative tasks:profiles=Printer Management,Media Backup,All;help=RtOperator.html 75ead1f93eSLiane PrazaPrimary Administrator:::Can perform all administrative tasks:auths=solaris.*,solaris.grant;help=RtPriAdmin.html 767c478bd9Sstevel@tonic-gateProcess Management:::Manage current processes and processors:auths=solaris.smf.manage.cron,solaris.smf.manage.power;help=RtProcManagement.html 777a286c47SDai NgoReparse Management:::Manage the reparse service:auths=solaris.smf.manage.reparse:help=RtReparseMngmnt.html 787c478bd9Sstevel@tonic-gateRights Delegation:::Delegate ability to assign rights to users and roles:auths=solaris.role.delegate,solaris.profmgr.delegate,solaris.grant;help=RtRightsDelegate.html 7918c2aff7SartemRmvolmgr Management:::Manage Removable Volume Manager SMF service:auths=solaris.smf.manage.rmvolmgr;help=RtRmvolmgrMngmnt.html 807c478bd9Sstevel@tonic-gateService Management:::Manage services:auths=solaris.smf.manage,solaris.smf.modify 817c478bd9Sstevel@tonic-gateService Operator:::Administer services:auths=solaris.smf.manage,solaris.smf.modify.framework 82f169c0eaSGlenn LagasseSoftware Installation:::Add application software to the system:profiles=ZFS File System Management;help=RtSoftwareInstall.html 83134a1f4eSCasper H.S. DikStop:::Last Profile evaluated, default profiles are not considered:help=RtReservedProfile.html 84ead1f93eSLiane PrazaSystem Administrator:::Can perform most non-security administrative tasks:profiles=Audit Review,Printer Management,Cron Management,Device Management,File System Management,Mail Management,Maintenance and Repair,Media Backup,Media Restore,Name Service Management,Network Management,Object Access Management,Process Management,Software Installation,User Management,Project Management,All;help=RtSysAdmin.html 857c478bd9Sstevel@tonic-gateSystem Event Management:::Manage system events and system event channels:help=RtSysEvMngmnt.html 867c478bd9Sstevel@tonic-gateUser Management:::Manage users, groups, home directory:auths=solaris.profmgr.read;help=RtUserMngmnt.html 87f875b4ebSricaUser Security:::Manage passwords, clearances:auths=solaris.role.*,solaris.profmgr.*,solaris.label.range;help=RtUserSecurity.html 887c478bd9Sstevel@tonic-gateFTP Management:::Manage the FTP server:help=RtFTPMngmnt.html 897c478bd9Sstevel@tonic-gateCrypto Management:::Cryptographic Framework Administration:help=RtCryptoMngmnt.html 907c478bd9Sstevel@tonic-gateKerberos Client Management:::Maintain and Administer Kerberos excluding the servers:help=RtKerberosClntMngmnt.html 917c478bd9Sstevel@tonic-gateKerberos Server Management:::Maintain and Administer Kerberos Servers:profiles=Kerberos Client Management;help=RtKerberosSrvrMngmnt.html 927c478bd9Sstevel@tonic-gateDAT Administration:::Manage the DAT configuration:help=RtDatAdmin.html 93da6c28aaSamwSMB Management:::Manage the SMB service:auths=solaris.smf.manage.smb,solaris.smf.value.smb,solaris.smf.read.smb;help=RtSMBMngmnt.html 944bff34e3SthurlowSMBFS Management:::Manage the SMB client:auths=solaris.smf.manage.smbfs,solaris.smf.value,solaris.smf.modify.application;help=RtSMBFSMngmnt.html 95fcf3ce44SJohn ForteSTMF Administration:::Configure STMF service:auths=solaris.smf.modify.application 96fcf3ce44SJohn ForteSTMF Management:::Start/Stop STMF service:auths=solaris.smf.manage.stmf 97fa9e4066SahrensZFS File System Management:::Create and Manage ZFS File Systems:help=RtZFSFileSysMngmnt.html 98fa9e4066SahrensZFS Storage Management:::Create and Manage ZFS Storage Pools:help=RtZFSStorageMngmnt.html 99cb8a054bSGlenn FadenZone Security:::Zones Virtual Application Environment Security:auths=solaris.zone.*,solaris.zone.grant;help=RtZoneSecurity.html 1007c478bd9Sstevel@tonic-gateZone Management:::Zones Virtual Application Environment Administration:help=RtZoneMngmnt.html 1017c478bd9Sstevel@tonic-gateIP Filter Management:::IP Filter Administration:help=RtIPFilterMngmnt.html 1027c478bd9Sstevel@tonic-gateProject Management:::Add/Modify/Remove projects:help=RtProjManagement.html 103911106dfSjmVSCAN Management:::Manage the VSCAN service:auths=solaris.smf.manage.vscan,solaris.smf.value.vscan,solaris.smf.modify.application;help=RtVscanMngmnt.html 104ff0e937bSRaymond ChenWUSB Management:::Manage Wireless USB:auths=solaris.admin.wusb.*,solaris.smf.manage.wusb;help=WUSBmgmt.html 105f6e214c7SGavin MaltbyEvent Notification Agent Management:::Manage Event Notification Agents:auths=solaris.smf.manage.smtp-notify,solaris.smf.manage.snmp-notify,solaris.smf.value.smtp-notify,solaris.smf.value.snmp-notify 106f875b4ebSrica# 107f875b4ebSrica# Trusted Extensions profiles: 108f875b4ebSrica# 109f875b4ebSricaInformation Security:::Maintains MAC and DAC security policies:profiles=Device Security,File System Security,Name Service Security,Network Security,Object Access Management,Object Label Management;help=RtInfoSec.html 11001a00981SPeter TribbleObject Label Management:::Change labels on files.:auths=solaris.device.allocate,solaris.label.file.downgrade,solaris.label.file.upgrade,solaris.label.range,solaris.smf.manage.labels;help=RtObjectLabelMngmnt.html 111f875b4ebSricaOutside Accred:::Allow a user to operate outside the user accreditation range.:auths=solaris.label.range;help=RtOutsideAccred.html 112d2ec54f7Sphitran# 113d2ec54f7Sphitran# Power Management profiles: 114d2ec54f7Sphitran# 115d2ec54f7SphitranSystem Power:::For authorized users to manage system power:auths=solaris.system.power.*;help=RtSysPowerMgmt.html 116d2ec54f7SphitranSuspend:::For authorized users to Suspend system:auths=solaris.system.power.suspend.*;help=RtSysPowerMgmtSuspend.html 117d2ec54f7SphitranSuspend To Disk:::For authorized users to Suspend to Disk:auths=solaris.system.power.suspend.disk;help=RtSysPowerMgmtSuspendToDisk.html 118d2ec54f7SphitranSuspend To RAM:::For authorized users to Suspend to RAM:auths=solaris.system.power.suspend.ram;help=RtSysPowerMgmtSuspendToRAM.html 119d2ec54f7SphitranBrightness:::For authorized users to Control LCD Brightness:auths=solaris.system.power.brightness;help=RtSysPowerMgmtBrightness.html 120a9da3307SnpCPU Power Management:::For authorized users to manage CPU Power:auths=solaris.system.power.cpu;help=RtCPUPowerManagement.html 121074e084fSmlacctadm:::Do not assign to users. Commands required for Extended Accounting Management profiles:help=RtAcctadm.help 122fcf3ce44SJohn ForteISNS Server Management:::Manage ISNS server:auths=solaris.smf.manage.isns,solaris.smf.value.isns,solaris.isnsmgr.write:help=RtISNSMngmnt.html 123