changeset 7948:6404ef908cc3

6748184 MMS appears to overlook the authorizations, and profiles best practices and the SMF policy 6707505 add mms rbac web pages
author David Major <David.Major@Sun.COM>
date Mon, 27 Oct 2008 15:06:22 -0500
parents 666f9a673ec3
children 55f219e084db
files usr/src/cmd/mms/mms.xml usr/src/lib/libsecdb/auth_attr.txt usr/src/lib/libsecdb/help/auths/AuthMMSDeviceLog.html usr/src/lib/libsecdb/help/auths/AuthMMSDeviceState.html usr/src/lib/libsecdb/help/auths/AuthMMSIORead.html usr/src/lib/libsecdb/help/auths/AuthMMSIOWrite.html usr/src/lib/libsecdb/help/auths/AuthMMSMedia.html usr/src/lib/libsecdb/help/auths/AuthMMSRequest.html usr/src/lib/libsecdb/help/auths/MMSHeader.html usr/src/lib/libsecdb/help/auths/Makefile usr/src/lib/libsecdb/help/auths/SmfManageMMS.html usr/src/lib/libsecdb/help/auths/SmfValueMMS.html usr/src/lib/libsecdb/help/profiles/Makefile usr/src/lib/libsecdb/help/profiles/RtMMSAdmin.html usr/src/lib/libsecdb/help/profiles/RtMMSOper.html usr/src/lib/libsecdb/help/profiles/RtMMSUser.html usr/src/lib/libsecdb/prof_attr.txt usr/src/pkgdefs/SUNW0on/prototype_com usr/src/pkgdefs/SUNWcsu/prototype_com
diffstat 19 files changed, 498 insertions(+), 30 deletions(-) [+]
line wrap: on
line diff
--- a/usr/src/cmd/mms/mms.xml	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/cmd/mms/mms.xml	Mon Oct 27 15:06:22 2008 -0500
@@ -53,17 +53,9 @@
 		type='astring'
                 value='solaris.smf.manage.mms' />
             <propval
-		name='modify_authorization'
-		type='astring'
-                value='solaris.smf.modify.mms' />
-            <propval
 		name='value_authorization'
 		type='astring'
-                value='solaris.smf.value.mms' />
-            <propval
-		name='read_authorization'
-		type='astring'
-                value='solaris.smf.read.mms' />
+                value='solaris.smf.manage.mms' />
         </property_group>
 
 	<property_group name='config' type='application'>
@@ -71,6 +63,10 @@
 		name='type'
 		type='astring'
 		value='server' />
+            <propval
+		name='value_authorization'
+		type='astring'
+                value='solaris.smf.value.mms' />
 	</property_group>
 
 	<property_group name='manager' type='application'>
@@ -153,6 +149,7 @@
 			exec=':kill -HUP'
 			timeout_seconds='60'>
 		</exec_method>
+
 		<property_group name='option' type='application'>
 		    <propval
 			name='ssi_path'
@@ -206,9 +203,9 @@
 			type='astring'
 			value='/var/mms/db/data' />
 		    <propval
-			name='log'
+			name='value_authorization'
 			type='astring'
-			value='log' />
+			value='solaris.smf.value.mms' />
 		</property_group>
 	</instance>
 
@@ -264,22 +261,19 @@
 			name='trace'
 			type='astring'
 			value='developer' />
-		</property_group>
-
-		<property_group name='option' type='application'>
 		    <propval
 			name='db_reconnect_max_retry'
 			type='integer'
 			value='50' />
-		</property_group>
-
-		<property_group name='option' type='application'>
 		    <propval
 			name='db_reconnect_timeout'
 			type='integer'
 			value='3' />
+	            <propval
+			name='value_authorization'
+			type='astring'
+			value='solaris.smf.value.mms' />
 		</property_group>
-
 	</instance>
 
 	<stability value='Unstable' />
@@ -287,16 +281,15 @@
 	<template>
 		<common_name>
 			<loctext xml:lang='C'>
-			Sun Media Management System service
+			    Media Management System service
 			</loctext>
 		</common_name>
 		<documentation>
-			<manpage title='mms_services' section='8'
-				manpath='/usr/man' />
+			<manpage title='mms' section='5'
+				manpath='/usr/share/man' />
 		</documentation>
 	</template>
 
-
 </service>
 
 </service_bundle>
--- a/usr/src/lib/libsecdb/auth_attr.txt	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/lib/libsecdb/auth_attr.txt	Mon Oct 27 15:06:22 2008 -0500
@@ -74,6 +74,7 @@
 solaris.mail.:::Mail::help=MailHeader.html
 solaris.mail.mailq:::Mail Queue::help=MailQueue.html
 #
+solaris.mms.:::Media Management System (MMS)::help=MMSHeader.html
 solaris.mms.media:::MMS Media Import, Export, Label and Move::help=AuthMMSMedia.html
 solaris.mms.request:::Handle MMS Device Manager Requests::help=AuthMMSRequest.html
 solaris.mms.device.state:::Start and Stop MMS Device Managers::help=AuthMMSDeviceState.html
@@ -185,9 +186,7 @@
 solaris.smf.value.iscsitgt:::Change Values of ISCSI Target Service Properties::help=SmfValueIscsitgt.html
 #
 solaris.smf.manage.mms:::Manage MMS Service States::help=SmfManageMMS.html
-solaris.smf.modify.mms:::Add/Remove Values of MMS Service Properties::help=SmfModifyMMS.html
 solaris.smf.value.mms:::Change Values of MMS Service Properties::help=SmfValueMMS.html
-solaris.smf.read.mms:::Read Permission for Protected MMS Service Properties::help=SmfReadMMS.html
 solaris.smf.manage.isns:::Manage iSNS Service States::help=isnsStates.html
 solaris.smf.value.isns:::Modify iSNS Service Property Values::help=isnsValue.html
 solaris.isnsmgr.write:::Modify iSNS configuration::help=AuthISNSmgrWrite.html
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSDeviceLog.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Change MMS Trace and Message Levels is in the Authorizations Included column, it grants the authorization to control the engineering trace level and the user message level for each component in MMS.
+<p>
+If Change MMS Trace and Message Levels is grayed, then you are not entitled to Add or Remove this authorization.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSDeviceState.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Start and Stop MMS Device Managers is in the Authorizations Included column, it grants the authorization to control the device managers.
+<p>
+If Start and Stop MMS Device Managers is grayed, then you are not entitled to Add or Remove this authorization. 
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSIORead.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Read Permission for MMS Volumes is in the Authorizations Included column, it grants the authorization to read Media Management System (MMS) media.
+<p>
+If Read Permission for MMS Volumes is grayed, then you are not entitled to Add or Remove this authorization.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSIOWrite.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Read and Write Permission for MMS Volumes is in the Authorizations Included column, it grants the authorization to read and write Media Management System (MMS) media.
+<p>
+If Read and Write Permission for MMS Volumes is grayed, then you are not entitled to Add or Remove this authorization.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSMedia.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When MMS Media Import, Export, Label and Move is in the Authorizations Included column, it grants the authorization to the media changer cap, slots, and the ability to label media.
+<p>
+If MMS Media Import, Export, Label and Move is grayed, then you are not entitled to Add or Remove this authorization. 
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/AuthMMSRequest.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Handle MMS Device Manager Requests is in the Authorizations Included column, it grants the authorization to respond to device manager requests.
+<p>
+If Handle MMS Device Manager Requests is grayed, then you are not entitled to Add or Remove this authorization. 
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/MMSHeader.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,34 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+    Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+    Use is subject to license terms.
+-->
+<HEAD>
+	<TITLE> </TITLE>
+	 
+	
+</HEAD>
+<BODY>
+
+The authorizations allow users access and the ability to manage the Media Management System (MMS).
+</BODY>
+</HTML>
--- a/usr/src/lib/libsecdb/help/auths/Makefile	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/lib/libsecdb/help/auths/Makefile	Mon Oct 27 15:06:22 2008 -0500
@@ -148,7 +148,16 @@
 	SysPowerMgmtSuspendtoRAM.html \
 	SysPowerMgmtBrightness.html \
 	SysCpuPowerMgmt.html \
-	SmfManageZFSSnap.html
+	SmfManageZFSSnap.html \
+	MMSHeader.html \
+	AuthMMSDeviceLog.html \
+	AuthMMSDeviceState.html \
+	AuthMMSIORead.html \
+	AuthMMSIOWrite.html \
+	AuthMMSMedia.html \
+	AuthMMSRequest.html \
+	SmfManageMMS.html \
+	SmfValueMMS.html
 
 HELPDIR=$(ROOT)/usr/lib/help
 AUTHDIR=$(HELPDIR)/auths
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/SmfManageMMS.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Manage MMS Service States is in the Authorizations Include column, it grants the authorization to enable, disable, or restart the mms service.
+<p>
+If Manage MMS Service States is grayed, then you are not entitled to Add or Remove this authorization.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/auths/SmfValueMMS.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+<BODY>
+
+When Change Values of MMS Service Properties is in the Authorizations Included column, it grants the the authorization to change MMS service property values.
+<p> 
+If Change Values of MMS Service Properties is grayed, then you are not entitled to Add or Remove this authorization.
+<p> 
+</BODY>
+</HTML>
--- a/usr/src/lib/libsecdb/help/profiles/Makefile	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/lib/libsecdb/help/profiles/Makefile	Mon Oct 27 15:06:22 2008 -0500
@@ -89,8 +89,10 @@
 	RtSysPowerMgmtSuspendtoDisk.html \
 	RtSysPowerMgmtSuspendtoRAM.html \
 	RtSysPowerMgmtBrightness.html \
-	RtCPUPowerManagement.html
-
+	RtCPUPowerManagement.html \
+	RtMMSAdmin.html \
+	RtMMSOper.html \
+	RtMMSUser.html
 
 HELPDIR =	$(ROOT)/usr/lib/help
 PROFDIR =	$(HELPDIR)/profiles
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/profiles/RtMMSAdmin.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+-- Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+-- Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+
+<BODY>
+When MMS Administrator is in the Rights Included column, it grants the right to administer the Media Management System (MMS) service, device managers, configuration, and the ability to do MMS I/O.
+<p>
+If MMS Administrator is grayed, then you are not entitled to Add or Remove this right.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/profiles/RtMMSOper.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+-- Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+-- Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+
+<BODY>
+When MMS Operator is in the Rights Included column, it grants the right to administer the Media Management System service and device managers, but not the right to modify the MMS configuration or the ability to do MMS I/O.
+<p>
+If MMS Operator is grayed, then you are not entitled to Add or Remove this right.
+<p>
+</BODY>
+</HTML>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/lib/libsecdb/help/profiles/RtMMSUser.html	Mon Oct 27 15:06:22 2008 -0500
@@ -0,0 +1,37 @@
+<HTML>
+<!--
+    CDDL HEADER START
+
+    The contents of this file are subject to the terms of the
+    Common Development and Distribution License (the "License").
+    You may not use this file except in compliance with the License.
+
+    You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+    or http://www.opensolaris.org/os/licensing.
+    See the License for the specific language governing permissions
+    and limitations under the License.
+
+    When distributing Covered Code, include this CDDL HEADER in each
+    file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+    If applicable, add the following below this CDDL HEADER, with the
+    fields enclosed by brackets "[]" replaced with your own identifying
+    information: Portions Copyright [yyyy] [name of copyright owner]
+
+    CDDL HEADER END
+
+-- Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+-- Use is subject to license terms.
+-->
+<HEAD>
+        <TITLE> </TITLE>
+
+
+</HEAD>
+
+<BODY>
+When MMS User is in the Rights Included column, it grants the right to do Media Management System (MMS) I/O, but not the right to administer the MMS service, device managers, or configuration.
+<p>
+If MMS User is grayed, then you are not entitled to Add or Remove this right.
+<p>
+</BODY>
+</HTML>
--- a/usr/src/lib/libsecdb/prof_attr.txt	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/lib/libsecdb/prof_attr.txt	Mon Oct 27 15:06:22 2008 -0500
@@ -54,9 +54,9 @@
 Maintenance and Repair:::Maintain and repair a system:auths=solaris.smf.manage.system-log,solaris.label.range,solaris.smf.manage.coreadm,solaris.smf.value.coreadm;help=RtMaintAndRepair.html
 Media Backup:::Backup files and file systems:profiles=NDMP Management;help=RtMediaBkup.html
 Media Restore:::Restore files and file systems from backups:profiles=NDMP Management;help=RtMediaRestore.html
-MMS Administrator:::MMS Media Manager Administrator:auths=solaris.smf.manage.mms,solaris.smf.modify.mms,solaris.smf.value.mms,solaris.mms.*
-MMS Operator:::MMS Media Manager Operator:auths=solaris.smf.manage.mms,solaris.mms.media.*,solaris.mms.request.*,solaris.mms.device.state.*,solaris.mms.device.log.*
-MMS User:::MMS Tape User:auths=solaris.mms.io.*
+MMS Administrator:::MMS Media Manager Administrator:auths=solaris.smf.manage.mms,solaris.smf.value.mms,solaris.mms.*;help=RtMMSAdmin.html
+MMS Operator:::MMS Media Manager Operator:auths=solaris.smf.manage.mms,solaris.mms.media.*,solaris.mms.request.*,solaris.mms.device.state.*,solaris.mms.device.log.*;help=RtMMSOper.html
+MMS User:::MMS Tape User:auths=solaris.mms.io.*;help=RtMMSUser.html
 NDMP Management:::Manage the NDMP service:auths=solaris.smf.manage.ndmp,solaris.smf.value.ndmp,solaris.smf.read.ndmp;help=RtNdmpMngmnt.html
 Network Autoconf:::Manage network auto-magic configuration via nwamd:auths=solaris.network.autoconf;help=RtNetAutoconf.html
 Network Management:::Manage the host and network configuration:auths=solaris.smf.manage.name-service-cache,solaris.smf.manage.bind,solaris.smf.value.routing,solaris.smf.manage.routing,solaris.smf.value.nwam,solaris.smf.manage.nwam,solaris.smf.manage.tnd,solaris.smf.manage.tnctl,solaris.smf.manage.wpa,solaris.smf.value.mdns,solaris.smf.manage.mdns;profiles=Network Wifi Management,Inetd Management,Network Autoconf;help=RtNetMngmnt.html
--- a/usr/src/pkgdefs/SUNW0on/prototype_com	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/pkgdefs/SUNW0on/prototype_com	Mon Oct 27 15:06:22 2008 -0500
@@ -324,6 +324,15 @@
 f none usr/lib/help/auths/locale/SysPowerMgmtBrightness.html 444 root bin
 f none usr/lib/help/auths/locale/SysCpuPowerMgmt.html 444 root bin
 f none usr/lib/help/auths/locale/SmfManageZFSSnap.html 444 root bin
+f none usr/lib/help/auths/locale/MMSHeader.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSMedia.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSRequest.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSDeviceState.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSDeviceLog.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSIORead.html 0444 root bin
+f none usr/lib/help/auths/locale/AuthMMSIOWrite.html 0444 root bin
+f none usr/lib/help/auths/locale/SmfManageMMS.html 0444 root bin
+f none usr/lib/help/auths/locale/SmfValueMMS.html 0444 root bin
 #
 d none usr/lib/help/profiles 755 root bin
 d none usr/lib/help/profiles/locale 755 root bin
@@ -390,6 +399,9 @@
 f none usr/lib/help/profiles/locale/RtSysPowerMgmtSuspendtoRAM.html 444 root bin
 f none usr/lib/help/profiles/locale/RtSysPowerMgmtBrightness.html 444 root bin
 f none usr/lib/help/profiles/locale/RtCPUPowerManagement.html 444 root bin
+f none usr/lib/help/profiles/locale/RtMMSAdmin.html 444 root bin
+f none usr/lib/help/profiles/locale/RtMMSOper.html 444 root bin
+f none usr/lib/help/profiles/locale/RtMMSUser.html 444 root bin
 #
 #
 # OCF Messages
--- a/usr/src/pkgdefs/SUNWcsu/prototype_com	Mon Oct 27 11:25:17 2008 -0700
+++ b/usr/src/pkgdefs/SUNWcsu/prototype_com	Mon Oct 27 15:06:22 2008 -0500
@@ -542,6 +542,15 @@
 f none usr/lib/help/auths/locale/C/SysPowerMgmtBrightness.html 0444 root bin
 f none usr/lib/help/auths/locale/C/SysCpuPowerMgmt.html 0444 root bin
 f none usr/lib/help/auths/locale/C/SmfManageZFSSnap.html 0444 root bin
+f none usr/lib/help/auths/locale/C/MMSHeader.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSMedia.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSRequest.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSDeviceState.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSDeviceLog.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSIORead.html 0444 root bin
+f none usr/lib/help/auths/locale/C/AuthMMSIOWrite.html 0444 root bin
+f none usr/lib/help/auths/locale/C/SmfManageMMS.html 0444 root bin
+f none usr/lib/help/auths/locale/C/SmfValueMMS.html 0444 root bin
 d none usr/lib/help/profiles 755 root bin
 d none usr/lib/help/profiles/locale 755 root bin
 d none usr/lib/help/profiles/locale/C 755 root bin
@@ -605,6 +614,9 @@
 f none usr/lib/help/profiles/locale/C/RtSysPowerMgmtSuspendtoRAM.html 444 root bin
 f none usr/lib/help/profiles/locale/C/RtSysPowerMgmtBrightness.html 444 root bin
 f none usr/lib/help/profiles/locale/C/RtCPUPowerManagement.html 444 root bin
+f none usr/lib/help/profiles/locale/C/RtMMSAdmin.html 444 root bin
+f none usr/lib/help/profiles/locale/C/RtMMSOper.html 444 root bin
+f none usr/lib/help/profiles/locale/C/RtMMSUser.html 444 root bin
 d none usr/lib/iconv 755 root bin
 f none usr/lib/iconv/646da.8859.t 444 root bin
 f none usr/lib/iconv/646de.8859.t 444 root bin