Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for RBAC configuration on solaris10 to achieve the below:

user=jon

group=jtu

jon is owner of /opt/app

user=ken

group=jtu

ken is owner of /data

on Linux I have added the below line

%jtu ALL= NOPASSWD: /bin/*, /usr/bin/* 

so that jon is able to access /data/tmp and delete files.

This doesn't work on solaris10 since there is no sudo by default.

How to configure RBAC in solaris10 for jon to be able to delete files in /data/tmp?

Thanks

share|improve this question
add comment

1 Answer

It's a bit of a palaver ...

First you need to work out which commands jon needs to run with different privilege

We'll assume that ken's uid is 1107 as we're going to give jon the ability to remove files and directories as if he were ken

Once you have the list add those commands to /etc/security/exec_attr using your favorite text editor like so

jonpriv:solaris:cmd:::/usr/bin/rm:uid=1107
jonpriv:solaris:cmd:::/usr/bin/rmdir:uid=1107

Create an authorization for jonpriv by adding the following to /etc/security/auth_attr

solaris.jonpriv.:::An authorization for jon::help=

Now create a profile for jon by editing /etc/security/prof_attr

jonpriv:::jons profile.:auths=solaris.jonpriv

finally give jon access to the profile

usermod -P jonpriv jon

jon can now use rm and rmdir as if he were ken thus

pfexec rm  some_file

pfexec rmdir some_directory

If it were me doing this for real I'd seriously consider installing sudo from sunfreeware

share|improve this answer
    
thank you for replying lain..i shall try this out and get back to you. –  Inv3r53 May 31 '10 at 18:14
    
it didnt work for me :( –  Inv3r53 Jun 1 '10 at 17:46
    
At which point does it not work - I just noticed a mistake in the usermod line and have fixed it in my answer. –  Iain Jun 1 '10 at 18:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.