role(5)

ROLE(5)

NAME

role - roles and privileges configuration for libnss-role

SYNOPSIS

/etc/role
/etc/role.d/*.role

DESCRIPTION

The role NSS module adds groups to groups: a user who is a member of a role group also gets all privilege groups of the role. Roles may include other roles, they are resolved recursively.

Each line of the file has the form

ROLE:GROUP[,GROUP...]

where ROLE is a role group and GROUPs are privilege groups (or other roles) which members of ROLE get.

Groups are specified by name or by numeric GID. Group names may contain spaces (e.g. domain users) and may be enclosed in double quotes. Spaces around names are ignored.
# starts a comment till the end of the line. Empty lines are ignored.
Several lines for the same role are merged.
Groups which don't exist are skipped: a line with a missing role is ignored, a missing privilege is removed from the role.

roleadd(8) and roledel(8) write group names, rolelst(8) shows the configuration.

FILES

/etc/role: the main configuration file.
/etc/role.d/*.role: additional configuration files, e.g. installed by packages. They are read in alphabetical order after /etc/role and merged with it. Only regular files with .role extension are read. A file /etc/role.d/ROLE.role which describes the role ROLE is a system role file, see -S option of the utilities.

EXAMPLE

Suppose that user pupkin is a member of the group users, and

# /etc/role
users: audio, video, cdwriter
admins: users, wheel

Then pupkin also gets the groups audio, video and cdwriter. Members of admins get all these groups and wheel.

To enable the module, add role to the group line of /etc/nsswitch.conf:

group: files role