howto prvent root on another sd partition from running sd-complex commands ?

[Sascha Krueger]

is there a way to prevent root on another superdome hard partition from running par* commands to change/view partition information ?

we would like to give the administration of a second hard partition to another department without letting them change the complex configuration. we wouldn´t even like them to view the config.

just removing the binaries is not appropriate. acl may be a way...

suggestions

[Stefan Farrelly · Accepted solution]

On their node simply swremove PartitionManager

This is the software that allows reconfiguring of a whole server (be it an SD or 7410/8410) - you dont have to have it installed. On the node you are giving to another dept to admin they dont need this software - its the only way to stop them accessing the whole server (or remove the installed binaries).

[Dietmar Konermann]

You cannot really prevent root from doing that... since root is allowed to re-install sowftware and re-configure the kernel. However, if you remove the hd_fabric driver from the kernel, then at least a reboot would be required to make the commands work again.

Best regards...
Dietmar.

[Sascha Krueger]

from your answers i understand that there is NO way to give away a prtition as if it were a standalone server. is that the point ?

thank you for quick help.

[Stefan Farrelly]

The only way to give away a server is to remove the software on it that allows them to access the whole phyiscal box (eg. an SD) - which is Partition Manager and/or Vpars (if its a vpar instead of an npar) - but if they have root access they could simply download and reinstall the software then access the whole server again!

[Sascha Krueger]

i understand.

thank you for making things clearer...

[Dietmar Konermann]

Sascha,

the "newer" Superdomes (IA64, PA8800) support a new MP command:

parperm

This command configures nPartition Configuration Privilege.

WARNING: When nPartition Configuration Privilege is unrestricted,
configuration commands issued by one partition can affect
the configuration of another partition. When this privilege
is restricted, configuration commands issued by a partition
cannot affect power or partition assignment of hardware not
already assigned to the partition. Restricting nPartition
configuration privilege does not restrict deallocation of
processors across partition boundaries.

nPartition Configuration Privilege is currently restricted.

Do you wish to unrestrict partition configuration (allowing partitions
to change the configuration of the platform)? (Y/[N])

---
Using this command protects the complex profile globally. So you could lock the configuration to prevent _all_ partitions' root users from changing the settings.

Best regards...
Dietmar.