POLICY.CONF(5) | File Formats and Configurations | POLICY.CONF(5) |
policy.conf - configuration file for security policy
/etc/security/policy.conf
The policy.conf file provides the security policy configuration for user-level attributes. Each entry consists of a key/value pair in the form:
key=value
The following keys are defined:
AUTHS_GRANTED
PROFS_GRANTED
CONSOLE_USER
PRIV_DEFAULT and PRIV_LIMIT
For maximum future compatibility, the privilege specifications should always include basic or all. Privileges should then be removed using negation. See EXAMPLES. By assigning privileges in this way, you avoid a situation where, following an addition of a currently unprivileged operation to the basic privilege set, a user unexpectedly does not have the privileges he needs to perform that now-privileged operation.
Note that removing privileges from the limit set requires extreme care, as any set-uid root program might suddenly fail because it lacks certain privilege(s). Note also that dropping basic privileges from the default privilege set can cause unexpected failure modes in applications.
LOCK_AFTER_RETRIES=YES|NO
CRYPT_ALGORITHMS_ALLOW
CRYPT_ALGORITHMS_DEPRECATE
CRYPT_DEFAULT
The key/value pair must appear on a single line, and the key must start the line. Lines starting with # are taken as comments and ignored. Option name comparisons are case-insensitive.
Only one CRYPT_ALGORITHMS_ALLOW or CRYPT_ALGORITHMS_DEPRECATE value can be specified. Whichever is listed first in the file takes precedence. The algorithm specified for CRYPT_DEFAULT must either be specified for CRYPT_ALGORITHMS_ALLOW or not be specified for CRYPT_ALGORITHMS_DEPRECATE. If CRYPT_DEFAULT is not specified, the default is __unix__.
Example 1 Defining a Key/Value Pair
AUTHS_GRANTED=solaris.date
Example 2 Specifying Privileges
As noted above, you should specify privileges through negation, specifying all for PRIV_LIMIT and basic for PRIV_DEFAULT, then subtracting privileges, as shown below.
PRIV_LIMIT=all,!sys_linkdir PRIV_DEFAULT=basic,!file_link_any
The first line, above, takes away only the sys_linkdir privilege. The second line takes away only the file_link privilege. These privilege specifications are unaffected by any future addition of privileges that might occur.
/etc/user_attr
/etc/security/auth_attr
/etc/security/prof_attr
/etc/security/policy.conf
See attributes(7) for descriptions of the following attributes:
ATTRIBUTE TYPE | ATTRIBUTE VALUE |
Interface Stability | Committed |
login(1), pfexec(1), chkauthattr(3SECDB), getexecuser(3SECDB), auth_attr(5), crypt.conf(5), prof_attr(5), user_attr(5), attributes(7), privileges(7)
The console user is defined as the owner of /dev/console.
February 25, 2008 | OmniOS |