topic Re: How to grant the privilege to other users? in Operating System - Tru64 Unix

How to grant the privilege to other users?

hy_3 — Fri, 27 Feb 2004 01:15:00 GMT

I want a normal user to have the privilege to kill the other users processes.How should I do?
Thnak you.OS are V4.0F and V5.1A.

Re: How to grant the privilege to other users?

Ravi_8 — Fri, 27 Feb 2004 02:07:08 GMT

Hi.

It's not a good process to give access to users to kill others processes.

anyway if you wish you can do so by using SUDO

Re: How to grant the privilege to other users?

hy_3 — Fri, 27 Feb 2004 02:17:45 GMT

Could you describe the 'SUDO' in detail?Thank you.By the way,what about the 'dop'?

Re: How to grant the privilege to other users?

Ralf Puchner — Fri, 27 Feb 2004 03:21:37 GMT

dop is the right choice on tru64 platforms. Have a look into the man page.

Another approach is to set the S-Bit on the ps command.

Re: How to grant the privilege to other users?

hy_3 — Fri, 27 Feb 2004 03:41:17 GMT

I do following the man page,but it does not work.Could you tell me how I should do?And the 'dop' is only available on V5,then on V4
what should I do?

Re: How to grant the privilege to other users?

Ravi_8 — Fri, 27 Feb 2004 05:58:26 GMT

Hi

dop is available in all versions
under /usr/sbin

#dop -n action

Re: How to grant the privilege to other users?

hy_3 — Sun, 29 Feb 2004 19:43:52 GMT

Could you please give me an example of 'dop'?Because I do as the man page telling me,but it does not work at all.Thank you.

Re: How to grant the privilege to other users?

hy_3 — Mon, 01 Mar 2004 19:47:10 GMT

Who can provide me some documents about 'dop'?The man page's description is not particular.Thank you.

Re: How to grant the privilege to other users?

PeterWolfe — Tue, 02 Mar 2004 14:19:01 GMT

Dop was available starting in V4.0 but
it was not formally supported on V4.x
systems. It was used internally when
launching CDE applications
(e.g. dxaccounts, dxfileshare,
etc. etc.) from the CDE Application
Manager.

Starting with V5.0, dop was documented
and exposed for customer use.

If you aren't worried about formal
support, on a V4.x system look at
/etc/doprc. Basically there are stanzas
that look like:

dop_action_name {
{path { }}
}

For example:

bindconfig {
{path { /usr/sbin/bindconfig }}
}

At the top of the file is a stanza:

global_admin {
{users { root }}
{groups { }}
}

If you add usernames to the users list
then that user can run any application
listed in /etc/doprc (i.e. he's the same
as root). That's typically not what you
want - you want to allow a specific user
to run a specific app or set of apps.
For this you can add the users and
groups stanzas to the application
stanzas. For example:

bindconfig {
{path { /usr/sbin/bindconfig }}
{users { pete }}
{groups { admins }}
}

From the command line you would do:
dop bindconfig

If I'm user Peter I'd be allowed to run
the application as root. If I'm in the
admins group, I'd be able to as well.

For V5.x there are command line and GUI
interfaces to DOP and you no longer hand
edit the /etc/doprc file. The features
change slightly as well. There is the
notion of privileges in later versions
of DOP.

pete