Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are you able to specify which profile you want to use for a given user when using pfexec who has been assigned multiple profiles?

One example for this use is so that we can execute a command as a different user within the same process. In exec_attr, you are able to specify the uid/gid that will be used to execute a particular command as in the following example entry:

Name Service Security:suser:cmd:::/usr/sbin/rpc.nsid:uid=0;gid=0

The above profile will use the super user (uid=0) to execute the rpc.nsid command.

In user_attr, you can specify multiple profiles as below: testuser::::type=normal;profiles=Name Service Security,Object Access Management

Can you then specify directly to use the Object Access Management profile to pfexec?

share|improve this question

From the [pfexec(1) man page][1]:

Profiles are searched in the order specified in the user's entry in the user_attr(4) database. If the same command appears in more than one profile, the profile shell uses the first matching entry.

So if you put 'Object Access Management' before 'Name Service Security' it'll use that instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.