System Administration Commands smattrpop(1M)
NAME
smattrpop - populate security attribute databases in a name
serviceSYNOPSIS
smattrpop [-c ] [-f] [-m] [-p policy] [-r] -s scope -t scope
[-v] database
DESCRIPTION
The smattrpop command updates the auth_attr(4),
exec_attr(4), prof_attr(4), and user_attr(4) role-based
access control databases in a target NIS, LDAP, or local /etc files name service from the corresponding databases in a source name service or files. This command processes the table entries from the source database and merges each source entry field into the samefield in the corresponding table entry in the target data-
base. If a source entry does not exist in the target data-
base, the entry is created. If the source entry exists in the target database, the fields are merged or replaced according to the command options. Any errors encountered while updating the target entry are reported to stdout, and the command continues with the next source database entry. OPTIONS The following options are supported:-c Performs cross-table checking. If you specify
this option and a check error occurs, a message identifying the check error is written to stdout. The target entry values are checked against entries in related databases:o auths values - Each value must exist
as the name of an authorization in theauth_attr(4) database.
o profiles values - Each value must
exist as a name of a profile in theprof_attr(4) database.
o roles values - Each value must exist
as the name of a role identity in theuser_attr(4) database.
SunOS 5.11 Last change: 11 Dec 2009 1
System Administration Commands smattrpop(1M)
o For each exec_attr(4) entry in the
source database, the name must exist as the name of a profile in theprof_attr(4) database.
-f Specifies that the value in each field in the
source entry replaces the value in the corresponding field in the target entry, if thesource entry field has a non-empty value.
-m For the auths, profiles, and roles attributes,
specifies that the values in each field in the source entry are merged with the values in the corresponding target entry field. If a source value does not exist in the target field, the value is appended to the set of target values. If the target field is empty, the source values replace the target field. The attribute values that merge depend on the database being updated:o prof_attr(4) - the auths and profiles
attribute values are merged.o user_attr(4) - the auths, profiles,
and roles attribute values are merged.o exec_attr(4) - the uid, gid, euid, and
egid values are merged.-p policy Specifies the value of the policy field in the
exec_attr(4) database. Valid values are suser
(standard Solaris superuser) and tsol (Trusted Solaris). If you specify this option, only theentries in the source exec_attr database with
the specified policy are processed. If you omit this option, all entries in the sourceexec_attr database are processed.
-r Specifies that role identities in the
user_attr(4) database in the source name ser-
vice are processed. If you omit this option,only the normal user entries in the user_attr
source database are processed.-s scope Specifies the source name service or local file
directory for database updates, using theSunOS 5.11 Last change: 11 Dec 2009 2
System Administration Commands smattrpop(1M)
following syntax: type:/server/domain where type indicates the type of name service. Valid values for type are:o file - local files
o nis - NIS name service
o ldap - LDAP name service
server indicates the local host name of theSolaris system on which the smattrpop command
is executed, and on which both the source and target databases exist. domain specifies the management domain name for the name service. You can use two special cases of scope values: o To indicate the databases in the /etc/security local system directory, use the scope file:/server, whereserver is the name of the local sys-
tem. o To load from databases in an arbitrary directory on the Solaris server, use the scope file:/server/pathname, where where server is the name of the localsystem and pathname is the fully-
qualified directory path name to the database files.-t scope Specifies the target name service or local file
directory for database updates, using the fol-
lowing syntax: type:/server/domain where type indicates the type of name service. Valid values for type are:o file - local files
o nis - NIS name service
SunOS 5.11 Last change: 11 Dec 2009 3
System Administration Commands smattrpop(1M)
o ldap - LDAP name service
server indicates the local host name of theSolaris system on which the smattrpop command
is executed, and on which both the source and target databases exist. domain specifies the management domain name for the name service. You can use two special cases of scope values: o To indicate the databases in the /etc/security local system directory, use the scope file:/server, whereserver is the name of the local sys-
tem. o To update to databases in an arbitrary directory on the Solaris server, use the scope file:/server/pathname, where where server is the name of the localsystem and pathname is the fully-
qualified directory path name to the database files.-v Specifies that verbose messages are written. A
message is written to stdout for each entry processed. OPERANDS The following operands are supported: database Populates one or all databases. You can specifyeither the name of the database you want to pro-
cess (for example, auth_attr), or all to process
all databases. If you specify all, the databases are processed in the following order:1. auth_attr(4)
2. prof_attr(4)
3. exec_attr(4)
4. user_attr(4)
EXAMPLES
Example 1 Populating all tables in the NIS name serviceSunOS 5.11 Last change: 11 Dec 2009 4
System Administration Commands smattrpop(1M)
The following example merges the values from all four attri-
bute databases in the /etc/security directory of the local system into the corresponding tables in the NIS domain, east.example.com. The command is executed on the master server, hoosier, for the NIS domain and the source files are in the /etc and /etc/security directories on the NIS masterserver. No cross-table checking is performed. A summary mes-
sage indicating the number of entries processed and updated for each table is written to stdout./usr/sadm/bin/smattrpop -s file:/hoosier \
-t nis:/hoosier/east.example.com all
ENVIRONMENT VARIABLESSee environ(5) for a description of the JAVA_HOME environ-
ment variable, which affects the execution of the smattrpop
command. If this environment variable is not specified, the /usr/java location is used. See smc(1M). EXIT STATUS Any errors encountered while updating the target entry are reported to stdout. The following exit values are returned: 0 The specified tables were updated. Individual entries may have encountered checking errors. 1 A syntax error occurred in the command line.2 A fatal error occurred and the tables were not com-
pletely processed. Some entries may have been updated before the failure. FILES/etc/security/auth_attr Authorization description data-
base. See auth_attr(4).
/etc/security/exec_attr Execution profiles database. See
exec_attr(4).
/etc/security/prof_attr Profile description database. See
prof_attr(4).
SunOS 5.11 Last change: 11 Dec 2009 5
System Administration Commands smattrpop(1M)
/etc/user_attr Extended user attribute database.
See user_attr(4).
ATTRIBUTES
See attributes(5) for descriptions of the following attri-
butes:____________________________________________________________
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
|_____________________________|_____________________________|
| Availability | SUNWmga ||_____________________________|_____________________________|
SEE ALSO
smc(1M), smexec(1M), smprofile(1M), auth_attr(4),
exec_attr(4), prof_attr(4), user_attr(4), attributes(5),
environ(5)SunOS 5.11 Last change: 11 Dec 2009 6