Role Based Access Control or RBAC is a powerful feature of OpenSolaris. However, all of the moving pieces involved can make it somewhat hard to comprehend. In this blog entry I attempt to distill what I've come to understand. First, some definitions:

Term	Description	Related File(s)	Command(s)
user	A user of the system	/etc/passwd /etc/user_attr	useradd usermod
role	A named set of authorizations that can be assumed	/etc/passwd /etc/user_attr	roleadd rolemod roles
profile	A named set of authorizations that can be executed against	/etc/security/exec_attr /etc/security/prof_attr	profiles pfexec
authorization	The privilege to do something on the system	/etc/security/auth_attr	auths

user

A user on the system. Basic user account information is defined in /etc/passwd:

bleonard@opensolaris:~$ grep "bleonard" /etc/passwd
bleonard:x:101:10:Brian Leonard:/export/home/bleonard:/bin/bash

The information includes my user name, password, id, group id, name, home directory and default shell.

Extended user information for RBAC is defined in /etc/user_attr:

bleonard@opensolaris:~$ grep "bleonard" /etc/user_attr 
bleonard::::profiles=Primary Administrator;roles=root

For me, user_attr defines one profile, Primary Administrator, and one role, root.

role

A role is a named set of authorizations that can be assumed. Like users, roles are also defined in the /etc/passwd file:

bleonard@opensolaris:~$ grep "root" /etc/passwd
root:x:0:0:Super-User:/root:/usr/bin/bash 

However, by default in OpenSolaris, root is defined as a role, not a user.

bleonard@opensolaris:~$ grep "root:" /etc/user_attr 
root::::type=role;auths=solaris.\*,solaris.grant;profiles=All;lock_after_retries=no;min_label=admin_low;clearance=admin_high

A user can assume a role. This is kind of like putting on a costume, however, you actually become what you're wearing. You assume a role with the su command. You need to enter the password you assigned the root role during installation:

bleonard@opensolaris:~$ su root
Password: 
bleonard@opensolaris:~# 

profile

A profile is a named set of authorizations that can be executed against. For that reason they're also called execution profiles.You execute against the profile using the pfexec command which stands for "profile execute". A lot of folks compare pfexec to sudo, and they can often be used interchangeably. But once you really understand pfexec, you realize how much more powerful it can be.

The commands that a given profile are allowed to execute are defined in /etc/security/exec_attr.

bleonard@opensolaris:~$ grep "Primary Administrator" /etc/security/exec_attr
Primary Administrator:suser:cmd:::\*:uid=0;gid=0

The \* means that Primary Administrator can execute all commands, and they're executed as root (uid=0).

The authorizations associated with the profile are defined in /etc/security/prof_attr:

bleonard@opensolaris:~$ grep "Primary Administrator" /etc/security/prof_attr 
Primary Administrator:::Can perform all administrative tasks:auths=solaris.\*,solaris.grant;help=RtPriAdmin.html

Authorization

An authorization gives you the privilege to do something. The solaris.\* wildcard authorization above gives the Primary Administrator the privilege to do everything. The full list of authorizations can be found in /etc/security/auth_attr.

RBAC In Action

To get a feel for how all of this works, let's mess with our default role and profile.

Playing with Roles

Let's remove the root role from user bleonard.

bleonard@opensolaris:~$ pfexec usermod -R "" bleonard
UX: usermod: bleonard is currently logged in, some changes may not take effect until next login.
bleonard@opensolaris:~$ grep "bleonard" /etc/user_attr 
bleonard::::type=normal;profiles=Primary Administrator 

Now, I can no longer assume the root role:

bleonard@opensolaris:~$ su root
Password: 
Roles can only be assumed by authorized users
su: Sorry

Well, since I'm still a Primary Administrator, I can still do it using pfexec:

bleonard@opensolaris:~$ pfexec su root
bleonard@opensolaris:~# 

Put the root role back:

bleonard@opensolaris:~# usermod -R root bleonard
UX: usermod: bleonard is currently logged in, some changes may not take effect until next login. 

Playing with Profiles

Let's remove the Primary Administrator profile from user bleonard (if you're trying this at home, be sure to put the root role back, otherwise you'll effectively remove all root access to your system).

bleonard@opensolaris:~$ pfexec usermod -P "" bleonard
UX: usermod: bleonard is currently logged in, some changes may not take effect until next login. 

Now try to put add the profile back :-):

bleonard@opensolaris:~$ pfexec usermod -P "Primary Administrator" bleonard
UX: usermod: ERROR: Permission denied.

Luckily, you can still assume the root role:

bleonard@opensolaris:~$ su 
Password: 
bleonard@opensolaris:~# usermod -P "Primary Administrator" bleonard
UX: usermod: bleonard is currently logged in, some changes may not take effect until next login.

A Basic UI

Finally, it's worth noting that there is a basic user interface for viewing and editing your users and roles. You'll find it under System > Administration > Users and Groups:

References

• RBAC and Privileges - Parts 1 - 4. A nice in depth tuturial which also covers privileges.
• Introducing pfexec, a Convenient Utility in the OpenSolaris OS