Hello.

I'd like to allow a group of users to manage (ie. disable, enable, ...)

a service, WITHOUT having to use sudo. That's supposed to be on a

Solaris 10 U4 system.

To allow one (or many indivial) user(s) to do the management, I followed

http://learningsola­ris.com/archives/200­5/04/25/smf_and_rbac­/, ie.

I did:

# usermod -A solaris.smf.manage.­nfs/server bob

# svccfg -s nfs/server setprop general/action_auth­orization=astring: \

'solaris.smf.manage­.nfs/server'

# svccfg -s nfs/server setprop general/value_autho­rization=astring: \

'solaris.smf.manage­.nfs/server'

# svcadm refresh nfs/server

After that, "bob" was able to do "/usr/sbin/svcadm disable nfs/server".

But now I'd like to have a group, let's call it "nfsadmins", that

should be able to do this.

How would I do this? I cannot do

# usermod -A solaris.smf.manage.­nfs/server nfsadmins

as there's no such user.

Hello.

I'd like to allow a group of users to manage (ie. disable, enable, ...)

a service, WITHOUT having to use sudo. That's supposed to be on a

Solaris 10 U4 system.

To allow one (or many indivial) user(s) to do the management, I followed

http://learningsola­ris.com/archives/200­5/04/25/smf_and_rbac­/, ie.

I did:

# usermod -A solaris.smf.manage.­nfs/server bob

# svccfg -s nfs/server setprop general/action_auth­orization=astring: \

'solaris.smf.manage­.nfs/server'

# svccfg -s nfs/server setprop general/value_autho­rization=astring: \

'solaris.smf.manage­.nfs/server'

# svcadm refresh nfs/server

After that, "bob" was able to do "/usr/sbin/svcadm disable nfs/server".

But now I'd like to have a group, let's call it "nfsadmins", that

should be able to do this.

How would I do this? I cannot do

# usermod -A solaris.smf.manage.­nfs/server nfsadmins

as there's no such user.

Thanks a lot,

Michael

Obviously, this should be part of groupmod, except that it isn't. That

sucks.

If Roles won't do this, you're stuck using sudo or rethinking your

approach. Your call...

Michael Vilain <vilain@NOspamcop.n­et> wrote:

Thanks for your reply. Maybe my approach isn't good. Let me tell,

what I'd like to be able to do.

On a development box, I've got developers doing their thing. This

includes building an application and "deploying" it, as they call

it. To do this, a service needs to be restarted. The service is

managed by SMF.

All these developers are in a Unix group called tcalpha. How would

I now go about allowing anyone, who's a member of "tcalpha", to

disable/enable/rest­art/mark the service called "tcalpha"? With sudo,

I'd know how to do this. I'd rather not allow every single user

to do this, but I'd rather make this permission dependent on the

group membership status.

How to do that in the "Solaris 10 way" (ie. with only Solaris 10

tools and esp. without sudo)?

Thanks,

Michael

As expected - it does not work; at least not with bash.

--($:~/tmp)-- cat suid-script.sh

#! /bin/sh

touch /tmp/touch.suid

Michael Schmarck <usenet-michael@sch­marck.cn> wrote:

As expected - it does not work; at least not with bash.

--($:~/tmp)-- cat suid-script.sh

#! /bin/sh

touch /tmp/touch.suid

--($:~/tmp)-- ls -la suid-script.sh

-rwsrwxrwx 1 root dba 34 Apr 3 06:56 suid-script.sh

--($:~/tmp)-- ./suid-script.sh

--($:~/tmp)--

--($:~/tmp)-- ls -la /tmp/touch.suid

-rw-r--r-- 1 mike staff 0 Apr 3 06:57 /tmp/touch.suid

If the suid part would've worked, the file /tmp/touch.suid would be

owned by root, wouldn't it?

Michael

Michael Schmarck schrieb:

i have no solaris by hand, but beside the -p Option for sh maybe this works:

#!/bin/sh

su - root -c touch /tmp/touch.suid

· Wolfgang <wtrappe@AT.web.de>­:

Why should I by using su? I don't really want to create a file

owned by right by using touch. That was just a test (suggested

by you, Wolfgang).

Michael Schmarck

Michael Schmarck schrieb:

i thought that a exec of a suid file maybe sets the euid and uid other

than su ... just a idea.