roleadm.1m (2010 09)

r
roleadm(1M) roleadm(1M)
NAME
roleadm - noninteractive editing of role-related information in RBAC databases
SYNOPSIS
roleadm add role [comments]
roleadm delete role
roleadm modify oldrolename newrolename
roleadm assign user role
roleadm revoke user [role ]
roleadm list [user=username][role=
rolename][sys]
DESCRIPTION
roleadm is a noninteractive command that allows users with the appropriate authorization to modify
and list the role information in /etc/rbac/user_role
, /etc/rbac/role_auth
, and
/etc/rbac/roles
.
See rbac (5) for information on these RBAC databases.
HP recommends that only the
authadm,
cmdprivadm, and roleadm commands be used to edit and
view the RBAC databases. Do not edit the RBAC files directly.
Options
roleadm recognizes the following options:
add role [comments]
Add a role to the system list of valid roles. Appends a line in /etc/rbac/roles
file with
rolename. You can enter an optional comment after the role.
delete role
Remove a role from the system list of valid roles. If role is present in /etc/rbac/roles
, remove
entry. If role is not present, then
roleadm returns an error code; see RETURN VALUE.
modify oldrolename newrolename
Change the name of a role. This option causes a modification of the RBAC databases
(etc/rbac/user_role
, /etc/rbac/role_auth, and /etc/rbac/roles
), replacing each
occurrence of oldrolename with newrolename .
assign user role
Assign a role to a user or a group. First verifies that the user is a valid user, and the role is present
in the /etc/rbac/roles
file. When this is the case, the role is appended to the user->role map-
ping in the
/etc/rbac/user_role
file. If user argument has an ampersand at the beginning
(such as &users), then it is assumed that what follows after the ampersand is a group name - the
ampersand must be shell escaped or put in quotes such as users or "&users".
An administrator may specify a default set of roles by assigning roles to the
DEFAULT keyword. If a
user is not otherwise explicitly assigned roles in the
/etc/rbac/user_role
database, he or she
will be given roles assigned to the
DEFAULT role.
revoke user [role]
Revoke a role from the specified user. If no role is specified, then all roles are revoked for the given
user. (The user entry is removed from /etc/rbac/user_role). If user argument has an
ampersand at the beginning (such as &users), then it is assumed that what follows after the amper-
sand is a group name - the ampersand must be shell escaped or put in quotes such as users or
"&users".
list [user=username][role=rolename][sys]
List user and role information from the RBAC databases, /etc/rbac/user_role and
/etc/rbac/roles.
If neither
user= nor role= are specified, then list all the users with assigned roles.
If
user=username is specified, then only the role(s) of the specified user will be listed. If user has
an ampersand at the beginning (such as &users), then it is assumed that what follows after the
ampersand is a group name - the ampersand must be shell escaped or put in quotes such as users or
"&users". If only role=rolename is specified, then only list the user(s) assigned to the specified
role. If both user=username and role=rolename are specified, then the entry with the user user-
name and role rolename will be listed, if it exists.
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1