Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for RBAC configuration on solaris10 to achieve the below:



jon is owner of /opt/app



ken is owner of /data

on Linux I have added the below line

%jtu ALL= NOPASSWD: /bin/*, /usr/bin/* 

so that jon is able to access /data/tmp and delete files.

This doesn't work on solaris10 since there is no sudo by default.

How to configure RBAC in solaris10 for jon to be able to delete files in /data/tmp?


share|improve this question

It's a bit of a palaver ...

First you need to work out which commands jon needs to run with different privilege

We'll assume that ken's uid is 1107 as we're going to give jon the ability to remove files and directories as if he were ken

Once you have the list add those commands to /etc/security/exec_attr using your favorite text editor like so


Create an authorization for jonpriv by adding the following to /etc/security/auth_attr

solaris.jonpriv.:::An authorization for jon::help=

Now create a profile for jon by editing /etc/security/prof_attr

jonpriv:::jons profile.:auths=solaris.jonpriv

finally give jon access to the profile

usermod -P jonpriv jon

jon can now use rm and rmdir as if he were ken thus

pfexec rm  some_file

pfexec rmdir some_directory

If it were me doing this for real I'd seriously consider installing sudo from sunfreeware

share|improve this answer
thank you for replying lain..i shall try this out and get back to you. – Inv3r53 May 31 '10 at 18:14
it didnt work for me :( – Inv3r53 Jun 1 '10 at 17:46
At which point does it not work - I just noticed a mistake in the usermod line and have fixed it in my answer. – Iain Jun 1 '10 at 18:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.