Specific commands, arguments and switches in RBAC

[Yair Zaretski]

I recently installed Role-Based Access Control on my system, and I’m having problems configuring additional commands to match my specific requirements. For example - I would like to assign an authorization for a role to be able to change ownership with any command swithc of any directory to any user in a specific file system.
What is the command I should specify in "cmd=" when entering the "cmdprivadm add" command?

[Chan 007]

Hi,

Please check the link and download the PDF file.

docs.hp.com/en/5991-1821/ch03s05.html

Chan

[Yair Zaretski]

Thanks, it helped a bit.
what i need is for a certain user to be able to run the command:
privrun chown USER_NAME DIR_NAME
where user_name could vary and the dir_name could be any directory within one specific file system.
what do i need to enter in the cmdprivadm command?

[Chan 007]

Hi

To acheive this you have to either set up a role based policy for the users who will perform such operation,

But on a consistency point, you should not allow this feature for changing ownership for many people in a group, if you intend to allow many people to perform such thing then what is the fun of Security.

Also This chown is done once in a life time and not reqularly so you should not give this to all. e.g /data might be supported by DBA's when you setup a OS, you would have given all rights for the DBAs (group) to perform this chown.

Chan

[Yair Zaretski]

could you please specify more about role based policy?

thanks

[Chan 007]

Hi Yair,

Please find this link, this has examples and step by step information what happens

http://www.sun.com/bigadmin/content/submitted/custom_roles_rbac.html

Chan

[doug hosking]

Chan, I believe the question was regarding HP-UX, not Solaris, RBAC. While the high level concepts are similar, the implementations are quite different.