HP-UX Reference (11i v3 07/02) - 5 Miscellaneous Topics (vol 9)

r
rbac(5) rbac(5)
/etc/rbac/role_auth
The /etc/rbac/role_auth
file defines the authorizations and/or subroles for each specified role.
Each authorization is specified in the form of (operation, object) pairs. The authorization pairs are defined
in the
/etc/rbac/auths
database file.
A subrole is just another role with authorizations. When a subrole is assigned to a role, the role inherits all
the authorizations of the subrole. The subrole name must be defined in the
/etc/rbac/roles
database
file. No recursive role definition is permitted. For example, if "role1" has a subrole of "role2", and if users
roleassign "role1" to "role2", this will cause a recursive definition of both "role1" and "role2", and the
roleassign command will fail.
Authorized users can use the authadm command to specify the authorizations and/or subroles for each
role in /etc/rbac/role_auth
(Refer to authadm(1M) for more information).
All authorizations and/or subroles associated with a role must be specified in a single entry. This entry can
be more than one line; however, each individual authorization pair must not exceed one line. Lines that
begin with alphanumeric characters followed by semicolons (:) are considered new entries. The entries are
in the following format:
role: (operation, object) subrole...
role: (operation, object)...
role: subrole (operation, object)...
role: subrole subrole...
These fields are defined as follows:
Field Description
role A valid role, as defined in
/etc/rbac/roles
.
operation A specific operation that can be performed on an object. For example,
hpux.printer.add
is the operation of adding a printer. Or, hpux.printer.* is
the operation of either adding or deleting a printer.
object The object the user can access. If
* is specified, all objects can be accessed by the opera-
tion.
More than one (operation, object) pair may be specified for a role.
subrole A valid role, as defined in /etc/rbac/roles
. It is assigned to another role.
The following line states that the role of
SecurityOfficer
has authorization of
(
hpux.passwd , /etc/passwd ) which means that the operation, hpux.passwd , can access the
object, /etc/passwd . SecurityOfficer
also has the ability to add and delete system users.
SecurityOfficer: (hpux.passwd, /etc/passwd)
(hpux.user.add, *)
(hpux.user.del, *)
The
PrinterAdm has authorization to perform
hpux.printer.add on all objects.
PrinterAdm: (hpux.printer.add, *)
The Administrator has subroles SecurityOfficer and PrinterAdm, and therefore, has all the authorizations
of both subroles as shown in the preceding examples.
Administrator: SecurityOfficer PrinterAdm
/etc/rbac/aud_filter
The
/etc/rbac/aud_filter file defines role and authorization audit filtering. Audit records will be
generated for users whose role and associated authorization is found in this file. If a user’s role and associ-
ated authorization is not found in the file, then no audit records specific to role and authorization will be
generated. Each authorization is specified in the form of operation, object pairs.
Authorized users (as specified in /etc/rbac/cmd_priv database file) can edit
/etc/rbac/aud_filter to specify the role and authorization to be audited.
All authorizations associated with a role must be specified in a single entry. Only one authorization may be
specified per role. The entries are of the following format:
HP-UX 11i Version 3: February 2007 − 4 − Hewlett-Packard Company 397