Assuming that a user called "operator" exists on the system and is configured to use...

The Stop rights profile is the simplest way to create a restricted shell. The authorizations and rights profiles that are assigned in the policy.conf file are not consulted. In the default configuration, the role or user is not assigned the Basic Solaris User rights profile, the Console User rights profile, or the solaris.device.cdrw authorization.

Example:

Assign the Desktop Applets rights profile and the Stop rights profile to the user.

# usermod -P "Desktop Applets,Stop" username

This user does not have the Basic Solaris User rights profile or the Console User rights profile. Therefore, no commands other than the commands in the Desktop Applets rights profile can be run by this user.

Note:

*The usermod utility modifies a user's login definition on the system. It changes the definition of the specified login and makes the appropriate login-related system file and file system changes.

*Synopsis

usermod [-u uid [-o]] [-g group] [-G group [, group...]]

[-d dir [-m]] [-s shell] [-c comment] [-l new_name]

[-f inactive] [-e expire]

[-A authorization [, authorization]]

[-P profile [, profile]] [-R role [, role]]

[-K key=value] login

*-P profile

One or more comma-separated rightsprofiles defined in prof_attr.

*prof_attr

- profile description database