--- a/ChangeLog	Fri Apr 08 11:56:45 2011 +0000
+++ b/ChangeLog	Fri Apr 08 14:43:06 2011 +0000
@@ -1,3 +1,14 @@
+2011-04-08  Brian Cameron  <[email protected]>
+
+	* specs/SUNWgnome-cd.spec, specs/SUNWgnome-cd-burner.spec,
+	  specs/SUNWgnome-media.spec, specs/SUNWdbus.spec,
+	  ext-sources/gdm.prof_attr,
+	  ext-sources/SUNWgnome-system-tools-exec_attr,
+	  ext-sources/SUNWprint-monitor-exec_attr,
+	  ext-sources/SUNWnwam-manager-exec_attr: Add "RO" to the "res1" field
+	  of all prof_attr and exec_attr RBAC entries delivered with the
+	  Desktop to comply with PSARC 2010/357.
+
 2011-04-08  Jan Hnatek <[email protected]>
 
 	* base-specs/ttf-freefont.spec:

--- a/ext-sources/SUNWgnome-system-tools-exec_attr	Fri Apr 08 11:56:45 2011 +0000
+++ b/ext-sources/SUNWgnome-system-tools-exec_attr	Fri Apr 08 14:43:06 2011 +0000
@@ -26,5 +26,5 @@
 #
 # execution attributes for profiles. see exec_attr(4)
 #
-User Management:solaris:cmd:::/usr/bin/users-admin:
-User Management:solaris:cmd:::/usr/share/setup-tool-backends/scripts/users-conf:uid=0
+User Management:solaris:cmd:RO::/usr/bin/users-admin:
+User Management:solaris:cmd:RO::/usr/share/setup-tool-backends/scripts/users-conf:uid=0

--- a/ext-sources/SUNWnwam-manager-exec_attr	Fri Apr 08 11:56:45 2011 +0000
+++ b/ext-sources/SUNWnwam-manager-exec_attr	Fri Apr 08 14:43:06 2011 +0000
@@ -26,5 +26,5 @@
 #
 # execution attributes for profiles. see exec_attr(4)
 #
-Network Autoconf Admin:solaris:cmd:::/usr/bin/nwam-manager-properties:
-Network Autoconf User:solaris:cmd:::/usr/lib/gnome-netstatus-applet:
+Network Autoconf Admin:solaris:cmd:RO::/usr/bin/nwam-manager-properties:
+Network Autoconf User:solaris:cmd:RO::/usr/lib/gnome-netstatus-applet:

--- a/ext-sources/SUNWprint-monitor-exec_attr	Fri Apr 08 11:56:45 2011 +0000
+++ b/ext-sources/SUNWprint-monitor-exec_attr	Fri Apr 08 14:43:06 2011 +0000
@@ -1,2 +1,2 @@
-Basic Solaris User:solaris:cmd:::/usr/lib/ospm/lp-queue-helper:replaced by Desktop Print Management
-Desktop Print Management:solaris:cmd:::/usr/lib/ospm/lp-queue-helper:euid=lp;gid=lp
+Basic Solaris User:solaris:cmd:RO::/usr/lib/ospm/lp-queue-helper:replaced by Desktop Print Management
+Desktop Print Management:solaris:cmd:RO::/usr/lib/ospm/lp-queue-helper:euid=lp;gid=lp

--- a/ext-sources/SUNWprint-monitor-prof_attr	Fri Apr 08 11:56:45 2011 +0000
+++ b/ext-sources/SUNWprint-monitor-prof_attr	Fri Apr 08 14:43:06 2011 +0000
@@ -1,2 +1,2 @@
-Console User:::Manage System as the Console User:profiles=Desktop Print Management;help=RtConsUser.html
-Desktop Print Management:::Allow operation on printers for desktop user:
+Console User:RO::Manage System as the Console User:profiles=Desktop Print Management;help=RtConsUser.html
+Desktop Print Management:RO::Allow operation on printers for desktop user:

--- a/ext-sources/gdm.prof_attr	Fri Apr 08 11:56:45 2011 +0000
+++ b/ext-sources/gdm.prof_attr	Fri Apr 08 14:43:06 2011 +0000
@@ -3,5 +3,5 @@
 #
 # profiles attributes. see prof_attr(4)
 #
-Desktop Configuration::::auths=solaris.smf.manage.dt.login
-Device Security::::auths=solaris.smf.manage.dt.login
+Desktop Configuration:RO:::auths=solaris.smf.manage.dt.login
+Device Security:RO:::auths=solaris.smf.manage.dt.login

--- a/specs/SUNWdbus.spec	Fri Apr 08 11:56:45 2011 +0000
+++ b/specs/SUNWdbus.spec	Fri Apr 08 14:43:06 2011 +0000
@@ -3,7 +3,7 @@
 #
 # includes module(s): dbus
 #
-# Copyright 2007 Sun Microsystems, Inc.
+# Copyright 2007, 2011, Oracle and/or its affiliates. All rights reserved.
 # This file and all modifications and additions to the pristine
 # package are under the same license as the package itself.
 #
@@ -140,7 +140,7 @@
 mkdir -p $RPM_BUILD_ROOT/etc/security/auth_attr.d
 echo 'solaris.smf.manage.dbus:::Manage D-BUS Service States::help=SmfDBUSStates.html' > $RPM_BUILD_ROOT/etc/security/auth_attr.d/system-library-dbus
 mkdir -p $RPM_BUILD_ROOT/etc/security/prof_attr.d
-echo 'D-BUS Management:::Manage D-BUS:auths=solaris.smf.manage.dbus;help=RtDBUSMngmnt.html' > $RPM_BUILD_ROOT/etc/security/prof_attr.d/system-library-dbus
+echo 'D-BUS Management:RO::Manage D-BUS:auths=solaris.smf.manage.dbus;help=RtDBUSMngmnt.html' > $RPM_BUILD_ROOT/etc/security/prof_attr.d/system-library-dbus
 
 %{?pkgbuild_postprocess: %pkgbuild_postprocess -v -c "%{version}:%{jds_version}:%{name}:$RPM_ARCH:%(date +%%Y-%%m-%%d):%{support_level}" $RPM_BUILD_ROOT}
 
@@ -269,6 +269,8 @@
 %endif
 
 %changelog
+* Wed Apr 06 2011 - [email protected]
+- Add "RO" to prof_attr config.
 * Wed Dec 29 2010 - [email protected]
 - move auth_attr and prof_attr files into auth_attr.d and prof_attr.d
 * Tue Jun 08 2010 - [email protected]
@@ -351,5 +353,3 @@
 * Fri Oct 21 2005 - [email protected]
 - Initial spec file created.
 
-
-

--- a/specs/SUNWgnome-cd-burner.spec	Fri Apr 08 11:56:45 2011 +0000
+++ b/specs/SUNWgnome-cd-burner.spec	Fri Apr 08 14:43:06 2011 +0000
@@ -1,7 +1,7 @@
 #
 # spec file for package brasero
 #
-# Copyright 2009 Sun Microsystems, Inc.
+# Copyright 2009, 2011, Oracle and/or its affiliates. All rights reserved.
 # This file and all modifications and additions to the pristine
 # package are under the same license as the package itself.
 #
@@ -137,7 +137,7 @@
 
 # exec_attr(4)
 cat >> $RPM_BUILD_ROOT/etc/security/exec_attr.d/desktop-cd-burning-brasero <<EOF
-Desktop Removable Media User:solaris:cmd:::/usr/bin/brasero:privs=sys_devices
+Desktop Removable Media User:solaris:cmd:RO::/usr/bin/brasero:privs=sys_devices
 EOF
 
 %if %build_l10n
@@ -212,6 +212,8 @@
 %endif
 
 %changelog
+* Wed Apr 06 2011 - [email protected]
+- Add "RO" to exec_attr config.
 * Tue Sep 28 2010 - [email protected]
 - Bump to 2.30.3(doo16845)
 * Tue Jun 08 2010 - [email protected]
@@ -297,5 +299,3 @@
 * Mon Aug 18 2008 - [email protected]
 - Initial version.
 
-
-

--- a/specs/SUNWgnome-cd.spec	Fri Apr 08 11:56:45 2011 +0000
+++ b/specs/SUNWgnome-cd.spec	Fri Apr 08 14:43:06 2011 +0000
@@ -3,7 +3,7 @@
 #
 # includes module(s): sound-juicer
 #
-# Copyright 2009 Sun Microsystems, Inc.
+# Copyright 2009, 2011, Oracle and/or its affiliates. All rights reserved.
 # This file and all modifications and additions to the pristine
 # package are under the same license as the package itself.
 #
@@ -93,7 +93,7 @@
 mkdir -p $RPM_BUILD_ROOT/etc/security/exec_attr.d
 # exec_attr(4)
 cat >> $RPM_BUILD_ROOT/etc/security/exec_attr.d/desktop-cd-ripping-sound-juicer <<EOF
-Desktop Removable Media User:solaris:cmd:::/usr/bin/sound-juicer:privs=sys_devices
+Desktop Removable Media User:solaris:cmd:RO::/usr/bin/sound-juicer:privs=sys_devices
 EOF
 
 cd $RPM_BUILD_ROOT%{_bindir}
@@ -163,6 +163,8 @@
 %config %ips_tag(restart_fmri=svc:/system/rbac:default) %attr (0444, root, sys) /etc/security/exec_attr.d/*
 
 %changelog
+* Wed Apr 06 2011 - [email protected]
+- Add "RO" to exec_attr config.
 * Tue Jun 08 2010 - [email protected]
 - Updated BuildRequires to fit SourceJuicer.
 * Fri Apr  3 2009 - [email protected]
@@ -233,5 +235,3 @@
 * Thu Jul 07 2005 - [email protected]
 - Initial spec-file created
 
-
-

--- a/specs/SUNWgnome-media.spec	Fri Apr 08 11:56:45 2011 +0000
+++ b/specs/SUNWgnome-media.spec	Fri Apr 08 14:43:06 2011 +0000
@@ -3,7 +3,7 @@
 #
 # includes module(s): gst, gst-plugins-base, gst-plugins-good
 #
-# Copyright 2009 Sun Microsystems, Inc.
+# Copyright 2009, 2011, Oracle and/or its affiliates. All rights reserved.
 # This file and all modifications and additions to the pristine
 # package are under the same license as the package itself.
 #
@@ -279,8 +279,8 @@
 
 # prof_attr(4)
 cat >> $RPM_BUILD_ROOT/etc/security/prof_attr.d/library-audio-gstreamer <<EOF
-Desktop Removable Media User:::Access removable media for desktop user:
-Console User::::profiles=Desktop Removable Media User
+Desktop Removable Media User:RO::Access removable media for desktop user:
+Console User:RO:::profiles=Desktop Removable Media User
 EOF
 
 %if %{!?_without_gtk_doc:0}%{?_without_gtk_doc:1}
@@ -392,6 +392,8 @@
 %endif
 
 %changelog
+* Wed Apr 06 2011 - [email protected]
+- Add "RO" to prof_attr config.
 * Thu Apr 15 2010 - [email protected]
 - Re-enable dependency on liboil.
 * Thu Feb 11 2010 - [email protected]
@@ -558,5 +560,3 @@
 * Thu Feb 26 2004 - [email protected]
 - Initial spec-file created
 
-
-