Using Rights Profiles in Zone Administration

This section covers tasks associated with using rights profiles in non-global zones.

How to Assign the Zone Management Profile

The Zone Management profile grants the power to manage all of the non-global zones on the system to a user.

You must be the global administrator in the global zone to perform this procedure.

1. Become superuser, or assume the Primary Administrator role.

   To create the role and assign the role to a user, see Using the Solaris Management Tools With RBAC (Task Map) in System Administration Guide: Basic Administration.

2. Create a role that includes the Zone Management rights profile, and assign the role to a user.

   • To create and assign the role by using the Solaris Management Console, see Configuring RBAC (Task Map) in System Administration Guide: Security Services. Refer to the task “How to Create and Assign a Role By Using the GUI.”

   • To create and assign the role on the command line, see Managing RBAC in System Administration Guide: Security Services. Refer to the task “How to Create a Role From the Command Line.”

Example—Using Profile Shells With Zone Commands

You can execute zone commands in a profile using the pfexec program. The program executes commands with the attributes specified by the user's profiles in the exec_attr database. The program is invoked by the profile shells pfksh, pfcsh, and pfsh.

Use the pfexec program to log in to a zone, for example, my-zone.

machine$ pfexec zlogin my-zone