Manual Pages for UNIX Operating System command usage for man smf_security

Standards, Environments, and Macros               smf_security(5)



NAME
     smf_security - service management facility security behavior

DESCRIPTION
     The  configuration  subsystem  for  the  service  management
     facility,  smf(5),  requires  privilege to modify the confi-
     guration of a service. Privileges are granted to a  user  by
     associating  the  authorizations described below to the user
     through user_attr(4) and prof_attr(4). See rbac(5).


     The following authorization is used to  manipulate  services
     and service instances.

     solaris.smf.modify    Authorized to add, delete,  or  modify
                           services,  service instances, or their
                           properties, and to read protected pro-
                           perty values.


  Property Group Authorizations
     The smf(5)  configuration  subsystem  associates  properties
     with  each  service and service instance. Related properties
     are grouped.  Groups  can  represent  an  execution  method,
     credential   information,  application  data,  or  restarter
     state. The ability to create or modify property  groups  can
     cause  smf(5) components to perform actions that can require
     operating  system  privilege.  Accordingly,  the   framework
     requires  appropriate  authorization  to manipulate property
     groups.


     Each property group has a type corresponding to its purpose.
     The core property group types are method, dependency, appli-
     cation, and framework. Additional property group  types  can
     be  introduced, provided they conform to the extended naming
     convention in smf(5). The  following  basic  authorizations,
     however, apply only to the core property group types:

     solaris.smf.modify.method

         Authorized to change values or create, delete, or modify
         a property group of type method.


     solaris.smf.modify.dependency

         Authorized to change values or create, delete, or modify
         a property group of type dependency.






SunOS 5.11          Last change: 20 May 2009                    1






Standards, Environments, and Macros               smf_security(5)



     solaris.smf.modify.application

         Authorized to change values, read protected values,  and
         create,  delete,  or  modify  a  property  group of type
         application.


     solaris.smf.modify.framework

         Authorized to change values or create, delete, or modify
         a property group of type framework.


     solaris.smf.modify

         Authorized to add, delete, or modify  services,  service
         instances,  or  their  properties, and to read protected
         property values.



     Property group-specific authorization can  be  specified  by
     properties contained in the property group.

     modify_authorization    Authorizations allow  the  addition,
                             deletion, or modification of proper-
                             ties within the property group,  and
                             the  retrieval  of  property  values
                             from  the  property  group  if  pro-
                             tected.


     value_authorization     Authorizations  allow  changing  the
                             values  of  any property of the pro-
                             perty          group          except
                             modify_authorization,     and    the
                             retrieval  of  any  property  values
                             except modify_authorization from the
                             property group if protected.


     read_authorization      Authorizations allow  the  retrieval
                             of  property  values within the pro-
                             perty  group.  The  presence  of   a
                             string-valued   property  with  this
                             name identifies the containing  pro-
                             perty  group as protected. This pro-
                             perty  has  no  effect  on  property
                             groups  of types other than applica-
                             tion. See Protected Property Groups.





SunOS 5.11          Last change: 20 May 2009                    2






Standards, Environments, and Macros               smf_security(5)



     The above authorization properties are  only  used  if  they
     have  type  astring.  If an instance property group does not
     have one of the properties, but the instance's service has a
     property  group  of  the  same  name  with the property, its
     values are used.

  Protected Property Groups
     Normally, all property values in the repository can be  read
     by  any user without explicit authorization. Property groups
     of non-framework types can be used to store properties  with
     values  that  require  protection. They must not be revealed
     except upon proper authorization. A property group's  status
     as protected is indicated by the presence of a string-valued
     read_authorization property. If this  property  is  present,
     the  values  of  all  properties  in  the  property group is
     retrievable only as described in Property  Group  Authoriza-
     tions.


     Administrative domains with policies that prohibit backup of
     data  considered sensitive should exclude the SMF repository
     databases from their backups. In the face of such a  policy,
     non-protected  property values can be backed up by using the
     svccfg(1M) archive command to create an archive of the repo-
     sitory without protected property values.

  Service Action Authorization
     Certain actions on service instances can result  in  service
     interruption  or  deactivation.  These  actions  require  an
     authorization to ensure that any  denial  of  service  is  a
     deliberate  administrative  action.  Such  actions include a
     request for execution of the refresh or restart methods,  or
     placement  of a service instance in the maintenance or other
     non-operational state. The  following  authorization  allows
     such actions to be requested:

     solaris.smf.manage    Authorized   to    request    restart,
                           refresh,  or  other state modification
                           of any service instance.



     In addition, the general/action_authorization  property  can
     specify   additional   authorizations  that  permit  service
     actions to be  requested  for  that  service  instance.  The
     solaris.smf.manage  authorization is required to modify this
     property.

  Defined Rights Profiles
     Two rights profiles are included that offer grouped authori-
     zations for manipulating typical smf(5) operations.




SunOS 5.11          Last change: 20 May 2009                    3






Standards, Environments, and Macros               smf_security(5)



     Service Management    A service manager can  manipulate  any
                           service  in the repository in any way.
                           It      corresponds       to       the
                           solaris.smf.manage                 and
                           solaris.smf.modify authorizations.

                           The service management profile is  the
                           minimum required to use the pkgadd(1M)
                           or pkgrm(1M) commands to add or remove
                           software   packages  that  contain  an
                           inventory of services in  its  service
                           manifest.


     Service Operator      A service operator has the ability  to
                           enable or disable any service instance
                           on the system, as well as request that
                           its  restart or refresh method be exe-
                           cuted.   It   corresponds    to    the
                           solaris.smf.manage                 and
                           solaris.smf.modify.framework  authori-
                           zations.

                           Sites  can  define  additional  rights
                           profiles customized to their needs.


  Remote Repository Modification
     Remote repository servers can deny modification attempts due
     to additional privilege checks. See NOTES.

SEE ALSO
     auths(1), profiles(1),  pkgadd(1M),  pkgrm(1M),  svccfg(1M),
     prof_attr(4), user_attr(4), rbac(5), smf(5)

NOTES
     The present version of smf(5) does not support remote  repo-
     sitories.


     When a service is configured to be started as root but  with
     privileges  different  from  limit_privileges, the resulting
     process is privilege  aware.   This  can  be  surprising  to
     developers  who  expect  seteuid()  to reduce
     privileges to basic or less.










SunOS 5.11          Last change: 20 May 2009                    4