Using Enhanced RBAC

System administrators should be knowledgeable in the following areas in order to effectively use Enhanced RBAC.

RBAC Authorizations
Authorizations are an important part of Role Based Access Control (RBAC). The operating system uses authorization strings to determine eligibility before performing a privileged operation. Related checks can be performed from within the code explicitly or can be done by the loader when running protected privileged executables.
RBAC roles
Roles are the mechanism used to assign authorizations to a user and to group a set of system administration tasks together. An AIX® role is primarily a container for a collection of authorizations.
RBAC privileges
The enhanced RBAC framework relies heavily on system privileges to allow non-privileged users to perform privileged tasks. A privilege is a mechanism used to grant a process augmented functionality in system calls.
Privileged command database
Authorizations, roles, and privileges allow granular security controls to be implemented. However, the exploitation of RBAC by various system operations allows an RBAC security policy to be enforced.
Privileged device database
The privileged device database stores the list of privileges that are allowed to read from or write to a device. This database provides a mechanism for an administrator to further control access to a device than can be managed through traditional device access controls.
Privileged file database
Many system configuration files in traditional UNIX systems are owned by the root user and are not directly modifiable by other users. RBAC allows a user to modify these system configuration files by activating a role and running a command to gain the privileges needed to modify the file.
Kernel security tables
The information contained in the authorization, role, privileged command, and privileged device databases is not used for security considerations until the data has been loaded into an area of the kernel designated as the kernel security tables (KST). In the enhanced RBAC mode, authorization and privilege checks are performed in the kernel, so the databases must be sent to the kernel before they can be used.
Disabling the root user
In enhanced RBAC mode, it is possible to configure the system so that the root user has no associated special powers and is treated by the system as a normal user.
Remote RBAC database support
In an enterprise environment, it is desirable to be able to implement and enforce a common security policy across all systems in the environment. If the databases that control the policy are stored independently on each system, management of the security policy becomes a burden for the designated system administrator. AIX enhanced RBAC mode allows the RBAC databases to be stored in LDAP so that the security policy for all systems in the environment can be centrally managed.
Size limits in enhanced RBAC
The following table lists the various limits for the RBAC-related elements:
Administering enhanced RBAC
This section describes common command line usage scenarios for administering RBAC. These examples illustrate major aspects of the functionality. SMIT interfaces are also provided for RBAC administration. The fastpath to RBAC SMIT menus is smit rbac.

Parent topic: Role-based access control