RBAC user cannot execute useradd on Solaris 10

Question

I am trying to create a user in Solaris 10 using RBAC who can execute the useradd and userdel commands. But for some reasons after i create the profile, role and user, this user gets a permission denied error when i execute the useradd command. I think i am folllowing the correct steps i think which are as follows:

Creating a Solaris Profile by adding in /etc/security/prof_attr Assign this Profile administrative commands in /etc/security/exec_attr

Adding a new Solaris role by using roleadd command Set Role password Assign this Role to the Profile using rolemod

6.Create a new user and assign this user to the role Add PATH=$PATH:/usr/sbin in the .profile of this user and export it. User created Login from this user to Solaris and run useradd. Receiving error UX:useradd: ERROR: Permission denied

I read in some threads and websites that to do this you have to do pfexec or provide sudo access to the role etc. But if Solaris provides RBAC, then above steos are as per Solaris documentation so it should have worked. Can someone please help clarify this or a way in which i can achieve this? Or maybe i am wrong and missing something?

Note: I can do the above if i create a root based user, but there is a requirement do achieve this with an RBAC user.

Answer 1

From your overall description you are missing one step. What you have is:

1. Create RBAC profile /etc/security/prof_attr
2. Create Command allowed for the profile /etc/security/exec_attr
3. Create role account and assign the profile to it. roleadd -s /usr/bin/pfksh -P "Created Profile" roleA && passwd roleA
4. Create the the user account and assign role to it. useradd -R roleA user01
5. Try to use the profile that is assigned to the role using user account. ( won't work)

You have two ways to make this work. Using your deployment you need the following:

• The user needs to become the role su - roleA and then the role can execute useradd via pfexec. pfexec useradd .. Or just assign the pfksh shell to the role user.

• Or assign the profile directly to the user. use pfexec or assing pfksh to the user shell. usermod -P "Created Profile" -s /usr/bin/pfksh user01; useradd

If you have problems you can use ppriv -eD useradd to see missing authorizations.