Role based access controls

/usr/bin/passwd {
#include <standard/base>
#include <standard/nameservice>
#include <standard/authentication>

#include <standard/consoles> ”_q°g /etc/.pwd.lock w, QOZP/etc/npasswd rwl, HOH“7etc/nshadow rwl, /etc/passwd* rwl, q0b’#etc/pwd.* rwl, /etc/pwdb.conf r, /etc/shadow* rwl, /etc/spwd.* rwl, /usr/lib/cracklib_dict.hwm r, /usr/lib/cracklib_dict.pwd r, /usr/lib/cracklib_diCt.pwi r, /var/run/utmp rw,

Fig. 4A

/usr/sbin/useradd I
#include <standard/base;
#include <standard/nameservice>
#inolude <standard/authentication>

/etc/default/useradd r, /etc/group* rwl, /etc/gshadow* rwl, /etc/login.defs r, /etc/passwd* rwl, /etc/.pwd.lOck rw, /etc/shadow* rwl, /etc/skel r, /etc/skel/** rl /home/** rw, /usr/lib/perl5/** r, /usr/sbin/adduser x, /usr/sbin/useradd Ex, /var/log/lastlog rw, /var/run/nscd.pid rw, /var/run/utmp rw, /var/spool/mail/* rw,

Fig. 4B

§oz- % genprof /bin/hrbash

Please start the role to be profiled in another window and exercise

S0l{§its functionality now. Once completed, select (U)pdate to continue, or (F)inish to exit.

Profiling: /bin/hrbash
Reading log entries from: /var/log/messages
got: (.508
[éarse log] / (F)inish

5‘ Updating profiles in /etc/subdomain.d/ O'~ __________________________________________________________________ __

5'|2_|--Execute: /usr/sbin/useraclcl [@nherit] / (P)rofile / (U)nconfined / (D)eny / Abo(r)t / (F)inish)

51/ \$l6 L 1 l L ( S26,/Ellxecutez /bin/ls s 8 52° 527- 5-Zr’

[®nherit] / (D)eny / Ab0(r)t / (F)inish)
S28)

$3‘! ~’Path: /usr/lib/pwdutils/liblog_syslog. so . l . O . 0 New Mode: 1:

1 - /usr/lib/pwdutils/liblog_syslog.so.1.0.0/Sqo [2 — /usr/lib/pwdutils/liblog__syslog.so.*] --/5369 S?’8€[(/-t)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish

S91-— Path: /etc/nsswitch.corif
New Mode: 1:

[1 — #include <abstractions/nameservice>]F5-(lb
2 — /etc/nsswitch.conf ~§‘{H

[(A)ll0w] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t /
(F)inish

§‘i$ e- Path: /etc/passwd.tmp3gt91P New Mode: lrw

1 - /etc/passwd.tmp3gt91P"SS0
[2 — /etc/passwd.*]""$'§?_
[(A)llow] / (D)eny / (Nlew / (G)lob / Glob w/(E)xt / Abo(r)t /

(F) inish