smitacl.group File

Purpose

Contains the group access control list (ACL) definitions for the System Management Interface Tool (SMIT).

Description

The /etc/security/smitacl.group file contains the group ACL definitions for SMIT. This is an ASCII file that contains a stanza for each system group. Each stanza is identified by a group name followed by a : (colon) and contains attributes in the form Attribute=Value. Each attribute pair ends with a newline character as does each stanza.

The file supports a default stanza. If an attribute is not defined, either the default stanza or the default value for the attribute is used.

A stanza contains the following attribute:

Item Description

Item	Description
screens	Describes the list of SMIT screens for this group. (It is of the type SEC_LIST.) Examples include: `screens = * # Permit all screen access. screens = !* # Deny all screen access. screens = # Allows no specific screens # (screens can be added on a per user basis) screens = user,group,!tcpip # Allow user & group # screens, but not # tcpip screen`

screens

Describes the list of SMIT screens for this group. (It is of the type SEC_LIST.) Examples include:

screens = *                 # Permit all screen access.
screens = !*                # Deny all screen access.
screens =                   # Allows no specific screens
                            # (screens can be added on a per user basis)
screens = user,group,!tcpip # Allow user & group
                            # screens, but not
                            # tcpip screen

For a typical stanza, see the "Examples" section. This file may viewed with the lssec command and modified with the chsec command.

The screen names specified in the screens attribute are SMIT fastpath values. Many SMIT fastpath values can be found in the commands documentation. The smit command may also be used to determine the fastpath of the current screen. Please see the smit command for more information.

Security

Access Control: This file grants read and write access to the root user, and read access to members of the security group.

Examples

A typical stanza looks like the following example for the group called group:
```
group:
        screens = *
```
To allow the mksysb screen only for a member of a group called bkupgrp, remove the default access to all screens and specify only the mksysb screen for the bkupgrp group by typing:
```
default:
        screens = 
bkupgrp:
        screens = mksysb
```
Note: Changing the default stanza will remove the default access to all screens for members of other groups.
To allow members of the security group to view the screens for user and group administration, add the following stanza:
```
security:
   screens = top_menu,security,users,groups
```
Additional screens may be granted to individual users by adding stanzas for each user to the smitacl.user file.

Files

Item	Description
/etc/security/roles	Contains the list of valid roles.
/etc/security/user.roles	Contains the list of roles for each user.
/etc/security/smitacl.group	Contains the group ACL definitions.
/etc/security/smitacl.user	Contains the user ACL definitions.