Print this page
9728 3secdb man pages need some tlc
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/man/man3secdb/getexecattr.3secdb
+++ new/usr/src/man/man3secdb/getexecattr.3secdb
1 1 '\" te
2 +.\" Copyright 2018 Peter Tribble
2 3 .\" Copyright (c) 2005, Sun Microsystems, Inc. All Rights Reserved.
3 4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 -.TH GETEXECATTR 3SECDB "May 27, 2014"
7 +.TH GETEXECATTR 3SECDB "Aug 13, 2018"
7 8 .SH NAME
8 9 getexecattr, free_execattr, setexecattr, endexecattr, getexecuser, getexecprof,
9 10 match_execattr \- get execution profile entry
10 11 .SH SYNOPSIS
11 12 .LP
12 13 .nf
13 14 cc [ \fIflag\fR... ] \fIfile\fR... -lsecdb -lsocket -lnsl [ \fIlibrary\fR... ]
14 15 #include <exec_attr.h>
15 16 #include <secdb.h>
16 17
17 18 \fBexecattr_t *\fR\fBgetexecattr\fR(\fBvoid\fR);
18 19 .fi
19 20
20 21 .LP
21 22 .nf
22 23 \fBvoid\fR \fBfree_execattr\fR(\fBexecattr_t *\fR\fIep\fR);
23 24 .fi
24 25
25 26 .LP
26 27 .nf
27 28 \fBvoid\fR \fBsetexecattr\fR(\fBvoid\fR);
28 29 .fi
29 30
30 31 .LP
31 32 .nf
32 33 \fBvoid\fR \fBendexecattr\fR(\fBvoid\fR);
33 34 .fi
34 35
35 36 .LP
36 37 .nf
37 38 \fBexecattr_t *\fR\fBgetexecuser\fR(\fBconst char *\fR\fIusername\fR, \fBconst char *\fR\fItype\fR,
38 39 \fBconst char *\fR\fIid\fR, \fBint\fR \fIsearch_flag\fR);
39 40 .fi
40 41
41 42 .LP
42 43 .nf
43 44 \fBexecattr_t *\fR\fBgetexecprof\fR(\fBconst char *\fR\fIprofname\fR, \fBconst char *\fR\fItype\fR,
|
↓ open down ↓ |
27 lines elided |
↑ open up ↑ |
44 45 \fBconst char *\fR\fIid\fR, \fBint\fR \fIsearch_flag\fR);
45 46 .fi
46 47
47 48 .LP
48 49 .nf
49 50 \fBexecattr_t *\fR\fBmatch_execattr\fR(\fBexecattr_t *\fR\fIep\fR, \fBchar *\fR\fIprofname\fR,
50 51 \fBchar *\fR\fItype\fR, \fBchar *\fR\fIid\fR);
51 52 .fi
52 53
53 54 .SH DESCRIPTION
54 -.sp
55 55 .LP
56 56 The \fBgetexecattr()\fR function returns a single \fBexec_attr\fR(4) entry.
57 57 Entries can come from any of the sources specified in the
58 58 \fBnsswitch.conf\fR(4) file.
59 59 .sp
60 60 .LP
61 61 Successive calls to \fBgetexecattr()\fR return either successive
62 62 \fBexec_attr\fR entries or \fINULL\fR. Because \fBgetexecattr()\fR always
63 -returns a single entry, the \fBnext\fR pointer in the \fBexecattr_t\fR data
63 +returns a single entry, the \fBnext\fR pointer in the \fBexecattr_t\fR data
64 64 structure points to \fINULL\fR.
65 65 .sp
66 66 .LP
67 67 The internal representation of an \fBexec_attr\fR entry is an \fBexecattr_t\fR
68 -structure defined in <\fBexec_attr.h\fR> with the following members:
68 +structure defined in <\fBexec_attr.h\fR> with the following members:
69 69 .sp
70 70 .in +2
71 71 .nf
72 72 char *name; /* name of the profile */
73 -char *type; /* type of profile */
74 73 char *policy; /* policy under which the attributes are */
75 74 /* relevant*/
75 +char *type; /* type of profile */
76 76 char *res1; /* reserved for future use */
77 77 char *res2; /* reserved for future use */
78 78 char *id; /* unique identifier */
79 79 kva_t *attr; /* attributes */
80 80 struct execattr_s *next; /* optional pointer to next profile */
81 81 .fi
82 82 .in -2
83 83
84 84 .sp
85 85 .LP
86 86 The \fBfree_execattr()\fR function releases memory. It follows the \fBnext\fR
87 87 pointers in the \fBexecattr_t\fR structure so that the entire linked list is
88 88 released.
89 89 .sp
90 90 .LP
91 91 The \fBsetexecattr()\fR function "rewinds" to the beginning of the enumeration
92 92 of \fBexec_attr\fR entries. Calls to \fBgetexecuser()\fR can leave the
93 93 enumeration in an indeterminate state. Therefore, \fBsetexecattr()\fR should be
94 94 called before the first call to \fBgetexecattr()\fR.
95 95 .sp
96 96 .LP
97 97 The \fBendexecattr()\fR function can be called to indicate that \fBexec_attr\fR
98 98 processing is complete; the library can then close any open \fBexec_attr\fR
99 99 file, deallocate any internal storage, and so forth.
100 100 .sp
101 101 .LP
102 102 The \fBgetexecuser()\fR function returns a linked list of entries that match
103 103 the \fItype\fR and \fIid\fR arguments and have a profile that has been assigned
104 104 to the user specified by \fIusername\fR, as described in \fBpasswd\fR(4).
105 105 Profiles for the user are obtained from the list of default profiles in
106 106 \fB/etc/security/policy.conf\fR (see \fBpolicy.conf\fR(4)) and the
107 107 \fBuser_attr\fR(4) database. Only entries in the name service scope for which
108 108 the corresponding profile entry is found in the \fBprof_attr\fR(4) database are
|
↓ open down ↓ |
23 lines elided |
↑ open up ↑ |
109 109 returned.
110 110 .sp
111 111 .LP
112 112 The \fBgetexecprof()\fR function returns a linked list of entries that match
113 113 the \fItype\fR and \fIid\fR arguments and have the profile specified by the
114 114 \fIprofname\fR argument. Only entries in the name service scope for which the
115 115 corresponding profile entry is found in the \fBprof_attr\fR database are
116 116 returned.
117 117 .sp
118 118 .LP
119 -Using \fBgetexecuser()\fR and \fBgetexecprof()\fR, programmers can search for
119 +Using \fBgetexecuser()\fR and \fBgetexecprof()\fR, programmers can search for
120 120 any \fItype\fR argument, such as the manifest constant \fBKV_COMMAND\fR. The
121 121 arguments are logically AND-ed together so that only entries exactly matching
122 122 all of the arguments are returned. Wildcard matching applies if there is no
123 123 exact match for an \fBID\fR. Any argument can be assigned the \fINULL\fR value
124 124 to indicate that it is not used as part of the matching criteria. The \fB\fR
125 125 search_flag controls whether the function returns the first match
126 126 (\fBGET_ONE\fR), setting the \fBnext\fR pointer to \fINULL\fR or all matching
127 127 entries (\fBGET_ALL\fR), using the \fBnext\fR pointer to create a linked list
128 -of all entries that meet the search criteria. See \fBEXAMPLES\fR.
128 +of all entries that meet the search criteria. See \fBEXAMPLES\fR.
129 129 .sp
130 130 .LP
131 131 Once a list of entries is returned by \fBgetexecuser()\fR or
132 132 \fBgetexecprof()\fR, the convenience function \fBmatch_execattr()\fR can be
133 133 used to identify an individual entry. It returns a pointer to the individual
134 134 element with the same profile name (\fIprofname\fR), type name (\fItype\fR),
135 135 and \fIid\fR. Function parameters set to \fINULL\fR are not used as part of the
136 136 matching criteria. In the event that multiple entries meet the matching
137 137 criteria, only a pointer to the first entry is returned. The
138 138 \fBkva_match\fR(3SECDB) function can be used to look up a key in a key-value
139 139 array.
140 140 .SH RETURN VALUES
141 -.sp
142 141 .LP
143 142 Those functions returning data only return data related to the active policy.
144 -The \fBgetexecattr()\fR function returns a pointer to a \fBexecattr_t\fR if it
143 +The \fBgetexecattr()\fR function returns a pointer to a \fBexecattr_t\fR if it
145 144 successfully enumerates an entry; otherwise it returns \fINULL\fR, indicating
146 145 the end of the enumeration.
147 146 .SH USAGE
148 -.sp
149 147 .LP
150 148 The \fBgetexecattr()\fR, \fBgetexecuser()\fR, and \fBgetexecprof()\fR functions
151 149 all allocate memory for the pointers they return. This memory should be
152 150 deallocated with the \fBfree_execattr()\fR call. The \fBmatch_execattr()\fR
153 151 function does not allocate any memory. Therefore, pointers returned by this
154 152 function should not be deallocated.
155 153 .sp
156 154 .LP
157 155 Individual attributes may be referenced in the \fBattr\fR structure by calling
158 156 the \fBkva_match\fR(3SECDB) function.
159 157 .SH EXAMPLES
160 158 .LP
161 -\fBExample 1 \fRFind all profiles that have the \fBping\fR command.
159 +\fBExample 1 \fRFind all profiles that have the \fBping\fR command.
162 160 .sp
163 161 .in +2
164 162 .nf
165 163 if ((execprof=getexecprof(NULL, KV_COMMAND, "/usr/sbin/ping",
166 164 GET_ONE)) == NULL) {
167 165 /* do error */
168 166 }
169 167 .fi
170 168 .in -2
171 169
172 170 .LP
173 171 \fBExample 2 \fRFind the entry for the \fBping\fR command in the Network
174 172 Administration Profile.
175 173 .sp
176 174 .in +2
177 175 .nf
178 176 if ((execprof=getexecprof("Network Administration", KV_COMMAND,
179 177 "/usr/sbin/ping", GET_ALL))==NULL) {
180 178 /* do error */
|
↓ open down ↓ |
9 lines elided |
↑ open up ↑ |
181 179 }
182 180 .fi
183 181 .in -2
184 182
185 183 .LP
186 184 \fBExample 3 \fRTell everything that can be done in the Filesystem Security
187 185 profile.
188 186 .sp
189 187 .in +2
190 188 .nf
191 -if ((execprof=getexecprof("Filesystem Security", KV_NULL, NULL,
189 +if ((execprof=getexecprof("Filesystem Security", NULL, NULL,
192 190 GET_ALL))==NULL)) {
193 191 /* do error */
194 192 }
195 193 .fi
196 194 .in -2
197 195
198 196 .LP
199 197 \fBExample 4 \fRTell if the \fBtar\fR utility is in a profile assigned to user
200 198 wetmore. If there is no exact profile entry, the wildcard (*), if defined, is
201 199 returned.
202 200 .sp
203 -.LP
204 -The following tells if the \fBtar\fR utility is in a profile assigned to user
205 -wetmore. If there is no exact profile entry, the wildcard (*), if defined, is
206 -returned.
207 -
208 -.sp
209 201 .in +2
210 202 .nf
211 203 if ((execprof=getexecuser("wetmore", KV_COMMAND, "/usr/bin/tar",
212 204 GET_ONE))==NULL) {
213 205 /* do error */
214 206 }
215 207 .fi
216 208 .in -2
217 209
218 210 .SH FILES
219 -.sp
220 211 .ne 2
221 212 .na
222 213 \fB\fB/etc/nsswitch.conf\fR\fR
223 214 .ad
224 215 .RS 29n
225 -configuration file lookup information for the name server switch
216 +configuration file lookup information for the name service switch
226 217 .RE
227 218
228 219 .sp
229 220 .ne 2
230 221 .na
231 222 \fB\fB/etc/user_attr\fR\fR
232 223 .ad
233 224 .RS 29n
234 225 extended user attributes
235 226 .RE
236 227
237 228 .sp
238 229 .ne 2
239 230 .na
240 231 \fB\fB/etc/security/exec_attr\fR\fR
241 232 .ad
242 233 .RS 29n
243 234 execution profiles
244 235 .RE
|
↓ open down ↓ |
9 lines elided |
↑ open up ↑ |
245 236
246 237 .sp
247 238 .ne 2
248 239 .na
249 240 \fB\fB/etc/security/policy.conf\fR\fR
250 241 .ad
251 242 .RS 29n
252 243 policy definitions
253 244 .RE
254 245
255 -.SH ATTRIBUTES
256 246 .sp
247 +.ne 2
248 +.na
249 +\fB\fB/etc/security/prof_attr\fR\fR
250 +.ad
251 +.RS 29n
252 +profile information
253 +.RE
254 +
255 +.SH ATTRIBUTES
257 256 .LP
258 257 See \fBattributes\fR(5) for descriptions of the following attributes:
259 258 .sp
260 259
261 260 .sp
262 261 .TS
263 262 box;
264 263 c | c
265 264 l | l .
266 265 ATTRIBUTE TYPE ATTRIBUTE VALUE
267 266 _
268 267 MT-Level MT-Safe
269 268 .TE
270 269
271 270 .SH SEE ALSO
272 -.sp
273 271 .LP
274 -\fBgetauthattr\fR(3SECDB), \fBgetuserattr\fR(3SECDB), \fBkva_match\fR(3SECDB),
275 -\fBexec_attr\fR(4), \fBpasswd\fR(4), \fBpolicy.conf\fR(4), \fBprof_attr\fR(4),
276 -\fBuser_attr\fR(4), \fBattributes\fR(5)
272 +\fBgetauthattr\fR(3SECDB), \fBgetprofattr\fR(3SECDB), \fBgetuserattr\fR(3SECDB),
273 +\fBkva_match\fR(3SECDB), \fBexec_attr\fR(4), \fBpasswd\fR(4),
274 +\fBpolicy.conf\fR(4), \fBprof_attr\fR(4), \fBuser_attr\fR(4),
275 +\fBattributes\fR(5)
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX