RBAC Commands

smexec

The smexec command is used to create, update, and delete rows in the exec_attr database. One of three options must be passed to the command upon execution: add, which adds an entry; delete, which deletes an entry; or modify, which updates an entry. In order to use smexec, the user must have the solaris.profmgr.execattr.write authorization. There are two sets of parameters that can be passed to smexec (depending on which option has been selected): authorization parameters and specific parameters for each option.

The authorization parameters are common to each option, and they specify the following characteristics:

For adding entries using smexec add, the following parameters can be passed on the command line:

An example smexec add operation looks like this:

# smexec add -hostname localhost -password xyz123 -username root -- -n
"Print Manager" -t cmd -c /usr/sbin/lpsched -u 0 -g 0

This entry adds the capability to start the printing service to the Printer Manager profile, with the effective UID and GID of 0 (that is, root).

For removing entries using smexec delete, the following parameters can be passed on the command line:

To remove the entry for lpsched, you would use the following command:

# smexec delete -hostname localhost -password xyz123 -username root -- -n
"Print Manager" -t cmd -c /usr/sbin/lpsched

For changing entries using smexec modify, the following parameters can be passed on the command line:

An example smexec modify operation looks like this:

# smexec modify -hostname localhost -password xyz123 -username root -- -n
"Print Manager" -t cmd -c /usr/some/new/path/lpsched -u 0 -g 0

This entry modifies the command to start the printing service for the Printer Manager profile, from the path /usr/sbin/lpsched to /usr/some/new/path/lpsched.

smmultiuser

The smmultiuser command is used to perform batch functions, such as adding or deleting a large number of users. This is particularly useful when a file already exists that specifies all of the required user data. For instance, a backup system may need a setup that is similar to a current production system. Rather than just copying the file systems directly, all of the operations associated with new account creation can be performed, such as creating home directories. In addition, the file that specifies the user data can be updated to include pathname changes. For example, if the original system’s home directories were exported using NFS, they could be mounted under the /export mount point on the new system, and the data in the user specification file could be updated accordingly before being processed. Or, if mount points changed at a later time, user data on the system could be modified by using the smmultiuser command as well.

Like smexec, smmultiuser has three options that must be passed to the command upon execution: add, which adds multiple user entries; delete, which deletes one or more user entries; and modify, which modifies a set of existing entries. In order to use smmultiuser to change passwords, the user must have the solaris.admin.usermgr.pswd authorization. Two sets of parameters—authorization parameters and operation parameters—can be passed to smmultiuser, depending on which option has been selected.

The authorization parameters are common to each option, and they specify the following characteristics:

For add, delete, and modify operations using smmultiuser, the following parameters can be passed on the command line:

In the following example, a set of records is read in from /home/paul/newaccounts.txt and added to the system:

# smmultiuser add -hostname localhost -p xyz123 -username root -- -I
/home/paul/newaccounts.txt

smuser

The smuser command is used to perform operations on user accounts, whether the data is retrieved from the local user databases or from NIS/NIS+. It is similar to smmultiuser; however, it is generally used only to add single users, rather than a set of users in batch mode. In addition to adding, deleting, and modifying user records, existing user data can be retrieved and listed. One of four options must be passed to the command upon execution: add, which adds an entry; delete, which deletes an entry; list, which lists all existing entries; or modify, which updates an entry. In order to use smuser add, delete, or modify, the user must have the solaris.profmgr.execattr.write authorization. However, only the solaris.admin.usermgr.write authorization is required to list entries.

There are two sets of parameters that can be passed to smuser (depending on which option has been selected): authorization parameters and specific parameters for each option. The authorization parameters are common to each option, and they specify the following characteristics:

For adding entries using smuser add, the parameters are similar to those discussed for adding users using useradd. The following parameters can be passed on the command line:

An example smuser add command is shown here:

# smuser add -H localhost -p xyz123 -u root -- -F "Paul Watters"
 -n walrus -c "Paul A Watters Director" –P jimmy123 –g 10 –u 1025

This command adds an account called walrus to the system for Paul Watters, with the password jimmy123. The UID for the account is 1025, and the GID is 10.

For removing entries using smuser delete, only the –n parameter (specifying the account name) needs to be passed on the command line. The following command would remove the account for walrus on the localhost:

# smuser delete -H localhost -p xyz123 -u root -- -n walrus

The smuser list command can display a list of users without any parameters, by using a command like this:

# smuser list -H localhost -p xyz123 -u root –-

For modifying entries using smuser modify, the same parameters can be passed on the command line as for smuser add, with any new supplied values resulting in the appropriate fields being updated. For example, to modify the default shell for a user to the Korn shell, the following command would be used:

# smuser update -H localhost -p xyz123 -u root -- -n walrus –s /bin/ksh

smprofile

The smprofile command is used to create, list, update, and delete profiles in the prof_attr database, using smprofile add, smprofile list, smprofile modify, and smprofile delete, respectively. The authorization arguments are similar to those used for smuser and smexec. For adding entries using smprofile add, the following parameters can be passed on the command line:

An example smprofile add command is shown here:

# smprofile add -H localhost -p xyz123 -u root -- -n "Password Manager" \
  -d "Change user passwords" -a solaris.admin.usermgr.pswd \
  -m PasswordManager.html

This command adds a profile for the Password Manager who has the authorization solaris.admin.usermgr.pswd to change passwords.

For listing entries using smprofile list, only the –n parameter cannot be passed on the command line, which optionally specifies the name of the profile to list. An example smprofile list command is shown here:

# smprofile list -H localhost -p xyz123 -u root --

For modifying entries using smprofile modify, the same parameters can be passed on the command line as for smprofile add. Any parameters specified will result in the corresponding field being updated. An example smprofile modify command is shown here:

# smprofile modify -H localhost -p xyz123 -u root -- \
  -n "Password Manager" -d "Modify user passwords

This example changes the description for the profile Password Manager.

For deleting entries using smprofile delete, only the –n parameter can be passed on the command line, which specifies the name of the profile to delete. An example smprofile delete command is shown here:

# smprofile delete -H localhost -p xyz123 -u root -- \
  -n "Password Manager"

smrole

The smrole command is used to perform operations on role accounts. It is generally used to add single roles rather than a set of roles in batch mode. In addition to adding, deleting, and modifying role account records, existing role data can be retrieved and listed. One of four options must be passed to the command upon execution: add, which adds an entry; delete, which deletes an entry; list, which lists all existing entries; or modify, which updates an entry. In order to use smrole add, delete, or modify, the user must have the solaris.role.write authorization. However, only the solaris.admin.usermgr.read authorization is required to list entries. There are two sets of parameters that can be passed to smrole (depending on which option has been selected): authorization parameters and specific parameters for each option. The authorization parameters are similar to those used for smuser.

For adding entries using smrole add, the following parameters can be passed on the command line:

An example smrole add command is shown here:

# smrole add -H localhost -p xyz123 -u root -- -F "System Manager" \
  -n bofh –P abc123 –G 10 –u 666

This command adds an account called bofh to the system for System Manager, with the password jimmy123. The UID for the account is 666, and the secondary GID is 10.

For removing entries using smrole delete, only the –n parameter, specifying the role account name, needs to be passed on the command line. The following command would remove the account for bofh on the localhost:

# smrole delete -H localhost -p xyz123 -u root -- -n bofh

The smrole list command can display a list of roles without any parameters, by using a command like this:

# smrole list -H localhost -p xyz123 -u root –-

For modifying entries using smrole modify, the same parameters can be passed on the command line as for smrole add, with any new supplied values resulting in the appropriate fields being updated. For example, to modify the default shell for a role to the Bourne shell, the following command would be used:

# smrole update -H localhost -p xyz123 -u root -- -n walrus –s /bin/sh