role-based access Control in Aix, part 2nd

User-defined roles

In this section, we will describe the user-defined roles.

Planning for user-defined roles

As discussed in part 1th, "predefined roles in RBAC", the AIX V6 includes three predefined roles. These predefined roles provide a recommended method for dividing administrative responsibilities.

These predefined roles can be modified or deleted, and appropriate, new roles can be created for different environments.

Note: The Isso, SA, and so roles are used by Trusted AIX. If your environment includes Trusted AIX, you may want to customize your RBAC environment by using user-defined roles.

Although these predefined roles apply to a variety of management requirements, there are times when responsibilities need to be further and finer grained. In this case, enhanced RBAC allows the creation of user-defined roles.

When you create a user-defined role, you should consider the following several points:

Name of the role

The name of the role should include some description, or insights into the role's function. The role name is limited to no more than 63 printable characters.

Authorized

Consider which authorizations should be assigned to the role.

Child roles

Consider whether the role should contain child roles. A child role is a convenient way to assign one or more pre-existing roles to a user-defined role.

Authentication

Whether the user must authenticate when using the role through the Swrole command.

Create a user-defined role

Some of the following roles and KST management commands are included in the AIX V6:

Mkrole

Create a new role. When the system is running in enhanced RBAC mode, the roles created in the role database can be assigned to the user immediately, but for security reasons, the roles should be used after sending the database to the Kernel security table (KST) through the Setkst command.

Rmrole

Deletes an existing role. When the system is running in enhanced RBAC mode, the roles removed from the role database will still be present in KST until the KST is updated with the Setkst command.