svcadm(1M)을 검색하려면 섹션에서 1M 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
getexecprof(3c)
Standard C Library Functions getexecattr(3C)
NAME
getexecattr, free_execattr, setexecattr, endexecattr, getexecuser,
getexecprof, match_execattr - get execution profile entry
SYNOPSIS
#include <exec_attr.h>
execattr_t *getexecattr(void);
void free_execattr(execattr_t *ep);
void setexecattr(void);
void endexecattr(void);
execattr_t *getexecuser(const char *username, const char *type,
const char *id, int search_flags);
execattr_t *getexecprof(const char *profname, const char *type,
const char *id, int search_flags);
execattr_t *match_execattr(execattr_t *ep, char *profname,
char *type, char *id);
DESCRIPTION
The getexecattr() function returns a single exec_attr(5) entry. Entries
can come from any of the sources specified in the nsswitch.conf(5)
file.
Only entries in the name service scope for which the corresponding pro‐
file entry is found in the prof_attr(5) database are returned.
Successive calls to getexecattr() return either successive exec_attr
entries or NULL. Because getexecattr() always returns a single entry,
the next pointer in the execattr_t data structure points to NULL.
The internal representation of an exec_attr entry is an execattr_t
structure defined in <exec_attr.h> with the following members:
char *name; /* name of the profile */
char *policy; /* policy under which the attributes are */
/* relevant*/
char *type; /* type of profile */
char *res1; /* reserved for future use */
char *res2; /* reserved for future use */
char *id; /* unique identifier */
kva_t *attr; /* attributes */
struct execattr_s *next; /* optional pointer to next profile */
The free_execattr() function releases memory. It follows the next
pointers in the execattr_t structure so that the entire linked list is
released.
The setexecattr() function "rewinds" to the beginning of the enumera‐
tion of exec_attr entries. Calls to getexecuser() can leave the enumer‐
ation in an indeterminate state. Therefore, setexecattr() should be
called before the first call to getexecattr().
The endexecattr() function can be called to indicate that exec_attr
processing is complete; the library can then close any open exec_attr
file, deallocate any internal storage, and so forth.
The getexecuser() function returns a linked list of entries that match
the type and id arguments and have a profile that has been assigned to
the user specified by username, as described in passwd(5). Profiles for
the user are obtained from the list of default profiles in /etc/secu‐
rity/policy.conf (see policy.conf(5)) and the user_attr(5) database.
Two sets of profiles may be assigned to a user, an authenticated set
for commands requiring user reauthentication, and another set for unau‐
thenticated commands. Corresponding search_flags can be used to
restrict the search to a single profile set. These two flags are mutu‐
ally exclusive. If neither flag is set, both profile sets are searched,
beginning with the authenticated set.
If GET_AUTH_PROF is specified, the database is searched for the user's
profiles which require reauthentication, starting with the profiles
assigned using the auth_profiles keyword in user_attr(5) and the
AUTH_PROFS_GRANTED keyword in policy.conf(5).
If GET_PROF is specified, the database is searched for the user's pro‐
files which do not require reauthentication, starting with the profiles
assigned using the profiles keyword in user_attr(5) and the
PROFS_GRANTED keyword in policy.conf(5).
The getexecprof() function returns a linked list of entries that match
the type and id arguments and have the profile specified by the prof‐
name argument. Only entries in the name service scope for which the
corresponding profile entry is found in the prof_attr database are
returned.
Using getexecuser() and getexecprof(), programmers can search for any
type argument, such as the manifest constant KV_COMMAND. The arguments
are logically AND-ed together so that only entries exactly matching all
of the arguments are returned. Wildcard matching applies if there is no
exact match for an ID. Any argument can be assigned the NULL value to
indicate that it is not used as part of the matching criteria. Two
search_flags control whether these functions return the first match or
all matching entries.
If GET_ONE is specified, these functions return the first match, set‐
ting the next pointer to NULL. Use GET_ONE when searching for the
attributes for one particular application.
If GET_ALL is specified, all matching entries are returned, using the
next pointer to create a linked list. The entire database is searched,
resulting in a much slower operation.
Once a list of entries is returned by getexecuser() or getexecprof(),
the convenience function match_execattr() can be used to identify an
individual entry. It returns a pointer to the individual element with
the same profile name ( profname), type name ( type), and id. Function
parameters set to NULL are not used as part of the matching criteria.
In the event that multiple entries meet the matching criteria, only a
pointer to the first entry is returned. The kva_match(3C) function can
be used to look up a key in a key-value array.
RETURN VALUES
Those functions returning data only return data related to the active
policy. The getexecattr() function returns a pointer to a execattr_t if
it successfully enumerates an entry; otherwise it returns NULL, indi‐
cating the end of the enumeration.
USAGE
The getexecattr(), getexecuser(), and getexecprof() functions all allo‐
cate memory for the pointers they return. This memory should be deallo‐
cated with the free_execattr() call. The match_execattr()( function
does not allocate any memory. Therefore, pointers returned by this
function should not be deallocated.
Individual attributes may be referenced in the attr structure by call‐
ing the kva_match(3C) function.
EXAMPLES
Example 1 Find all profiles that have the ping command.
if ((execprof=getexecprof(NULL, KV_COMMAND, "/usr/sbin/ping",
GET_ALL)) == NULL) {
/* do error */
}
Example 2 Find the entry for the ping command in the Network Adminis‐
tration Profile.
if ((execprof=getexecprof("Network Administration", KV_COMMAND,
"/usr/sbin/ping", GET_ONE))==NULL) {
/* do error */
}
Example 3 Tell everything that can be done in the Filesystem Security
profile.
if ((execprof=getexecprof("Filesystem Security", NULL, NULL,
GET_ALL))==NULL)) {
/* do error */
}
Example 4 Check if a utility is in a profile assigned to a given user
The following tells if the tar utility is in a profile assigned to user
wetmore. If there is no exact profile entry, the wildcard (*), if
defined, is returned.
if ((execprof=getexecuser("wetmore", KV_COMMAND, "/usr/bin/tar",
GET_ONE))==NULL) {
/* do error */
}
FILES
/etc/nsswitch.conf configuration file lookup information for
the name service switch
/etc/user_attr extended user attributes
/etc/security/exec_attr execution profiles
/etc/security/policy.conf policy definitions
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ MT-LevelMT-Safe
SEE ALSO
getauthattr(3C), getuserattr(3C), kva_match(3C), exec_attr(5),
passwd(5), policy.conf(5), prof_attr(5), user_attr(5), attributes(7)
Oracle Solaris 11.4 17 Aug 2018 getexecattr(3C)