Home / server / Questions / 149867
In Process
jigjig
Asked: 2010-06-10 14:55:26 +0800 CST

Are you able to specify a the profile you want to use in pfexec?

  • 772

Are you able to specify which profile you want to use for a given user when using pfexec who has been assigned multiple profiles?

One example for this use is so that we can execute a command as a different user within the same process. In exec_attr, you are able to specify the uid/gid that will be used to execute a particular command as in the following example entry:

Name Service Security:suser:cmd:::/usr/sbin/rpc.nsid:uid=0;gid=0

The above profile will use the super user (uid=0) to execute the rpc.nsid command.

In user_attr, you can specify multiple profiles as below: testuser::::type=normal;profiles=Name Service Security,Object Access Management

Can you then specify directly to use the Object Access Management profile to pfexec?

opensolaris rbac

1 Answers

  1. From the [pfexec(1) man page][1]:

    Profiles are searched in the order specified in the user's entry in the user_attr(4) database. If the same command appears in more than one profile, the profile shell uses the first matching entry.

    So if you put 'Object Access Management' before 'Name Service Security' it'll use that instead.

    • 1