svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
pam_unix_cred(7)
pa...d(7)Standards, Environments, Macros, Character Sets, and miscellanpya...d(7)
NAME
pam_unix_cred - PAM user credential management module for UNIX
SYNOPSIS
pam_unix_cred.so.1 [debug] [nowarn]
[noannotation | annotation_prompt="prompt string"]
DESCRIPTION
The pam_unix_cred module implements pam_sm_setcred(3PAM). It provides
functions that establish user credential information. It is a module
separate from the pam_unix_auth(7) module to allow replacement of the
authentication functionality independently from the credential func‐
tionality.
The pam_unix_cred module must always be stacked along with whatever au‐
thentication module is used to ensure correct credential setting.
Authentication service modules must implement both pam_sm_authenti‐
cate() and pam_sm_setcred().
pam_sm_authenticate() in this module always returns PAM_IGNORE.
pam_sm_setcred() initializes the user's project and privilege sets,
initializes or updates the user's audit context if it hasn't already
been initialized, and sets the process clearance.
The new clearance is set to the lower bound of the current process
clearance and the minimum label returned by getuserrange(3TSOL). If
these two labels are disjoint, the clearance is set to the greatest
lower bound.
The following flags may be set in the flags field:
PAM_ESTABLISH_CRED
PAM_REFRESH_CRED
PAM_REINITIALIZE_CRED
Initializes the user's project to the project specified in PAM_RE‐
SOURCE, or if PAM_RESOURCE is not specified, to the user's default
project. Establishes the user's privilege sets.
If the audit context is not already initialized and auditing is
configured, these flags cause the context to be initialized to that
of the user specified in PAM_AUSER (if any) merged with the user
specified in PAM_USER and host specified in PAM_RHOST. If PAM_RHOST
is not specified, PAM_TTY specifies the local terminal name. At‐
tributing audit to PAM_AUSER and merging PAM_USER is required for
correctly attributing auditing when the system entry is performed
by another user that can be identified as trustworthy.
If the audit context is already initialized, the PAM_REINITIAL‐
IZE_CRED flag merges the current audit context with that of the
user specified in PAM_USER. PAM_REINITIALIZE_CRED is useful when a
user is assuming a new identity, as with su(8).
PAM_ESTABLISH_CRED
PAM_REINITIALIZE_CRED
Prompt for an "audit record annotation string" for a PAM_USER who
is configured to request audit record annotation.
Create subdirectories for the user, if they don't already exist, in
the /var/user and /tmp/volatile-user directories. The persistent
/var/user subdirectory will not be created for users logging in
with an emphemeral user id.
PAM_DELETE_CRED
This flag has no effect and always returns PAM_SUCCESS.
The following options are interpreted:
debug
Provides syslog(3C) debugging information at the LOG_DEBUG level.
nowarn
Disables any warning messages.
noannotation
Do not prompt for audit record annotation. It is an error to in‐
clude this option and the annotation_prompt= option.
annotation_prompt="prompt string"
Provides a prompt string to override the default audit record anno‐
tation prompt of Session Annotation:. The prompt string must imme‐
diately follow the =. If the string following the = contains white
space, it must be surrounded by quotation marks, for example anno‐
tation_prompt="My Prompt String". It is an error to include both
this option and the noannotation option.
RETURN VALUES
Upon successful completion of pam_sm_setcred(), PAM_SUCCESS is re‐
turned. The following error codes are returned upon error:
PAM_CRED_UNAVAIL Underlying authentication service cannot retrieve
user credentials
PAM_CRED_EXPIRED User credentials have expired
PAM_USER_UNKNOWN User is unknown to the authentication service
PAM_CRED_ERR Failure in setting user credentials
PAM_BUF_ERR Memory buffer error
PAM_SERVICE_ERR An illegal option
PAM_SYSTEM_ERR System error
The following values are returned from pam_sm_authenticate():
PAM_IGNORE Ignores this module regardless of the control flag
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Availabilitysystem/library/pam-core _ Interface Stabil‐
ityCommitted
SEE ALSO
ssh(1), settaskid(2), syslog(3C), libpam(3LIB), pam(3PAM),
pam_set_item(3PAM), pam_sm_authenticate(3PAM), pam_sm_setcred(3PAM),
setproject(3PROJECT), getprojent(3PROJECT), nsswitch.conf(5),
pam.conf(5), project(5), user_attr(5), attributes(7), labels(7),
pam_authtok_check(7), pam_authtok_get(7), pam_authtok_store(7),
pam_dhkeys(7), pam_passwd_auth(7), pam_unix_account(7),
pam_unix_auth(7), pam_unix_session(7), privileges(7), su(8)
NOTES
If this module is replaced, the audit context and credential may not be
correctly configured.
HISTORY
Creation of a subdirectory under /tmp/volatile-user for the user was
added in Oracle Solaris 11.4.0.
Prompting for an audit record annotation string, along with support for
the annotation_prompt and noannotation options, was added in Oracle So‐
laris 11.4.0.
Setting the process clearance level was added in Oracle Solaris 11.4.0.
Creation of a subdirectory under /var/user for the user was added in
Oracle Solaris 11.0.0.
Initializing privilege sets was added to pam_unix_cred in Solaris 10
3/05, as part of the introduction of privilege sets to the operating
system.
Setting the project was added to pam_unix_cred in Solaris 10 3/05.
Prior Prior to that, this work was performed in the pam_project module.
The pam_unix_cred module was introduced in Solaris 9, and later back‐
ported to patches for Solaris 8. This included support for the debug
and nowarn options. Prior to that, this work was performed in the
pam_unix module.
Oracle Solaris 11.4 12 Sep 2023 pa...d(7)