RBAC的问题

stevens_wu

打算让一个普通用户test拥有关机和配置无线网络的权限，用usermod来指定了auth和profile
# cat /etc/user_attr
#
# Copyright (c) 2003 by Sun Microsystems, Inc. All rights reserved.
#
# /etc/user_attr
#
# user attributes. see user_attr(4)
#
#pragma ident   "@(#)user_attr 1.1      03/07/09 SMI"
#
adm::::profiles=Log Management
lp::::profiles=Printer Management
root::::auths=solaris.*,solaris.grant;profiles=Web Console Management,All;lock_after_retries=no
?::::type=role;profiles=All
stevens::::type=normal;auths=solaris.network.*
test::::type=normal;auths=solaris.system.shutdown;profiles=System Administrator
但是当我用test用户登陆执行shutdown时
$ shutdown
/usr/sbin/shutdown:  Only root can run /usr/sbin/shutdown
请教这是什么问题？而且test用户也没有权限来配置接口
ifconfig: plumb: iwi0: Permission denied
wificonfig: set permitted priviledge: Not owner
/sbin/dhcpagent: error: must be super-user
ifconfig: unable to start /sbin/dhcpagent

zhuangpeipei

尝试一下 没有具体实践过
先用useradd加好test用户,用roleadd加好haltrole
/etc/security/exec_attr 加一行
shutdown Management:suser:cmd:::/usr/sbin/shutdown:euid=0
/etc/security/prof_attr 加一行
shutdown Management:::Able to shutdown the system:
/etc/user_attr 修改如下两行
haltrole::::type=role;profile=shutdown Management,ALL
test::::type=normal;roles=haltrole
设定好两个用户的密码
关机的时候,先用test用户su 成haltrole 再用shutdown
配网络类似 把shutdown改成ifconfig 再设定role和用户就可以了

[ 本帖最后由 zhuangpeipei 于 2006-5-10 11:04 编辑 ]

stevens_wu

按照楼上的设置，还是出现错误
$ shutdown
/usr/sbin/shutdown:  Only root can run /usr/sbin/shutdown

zhuangpeipei

# roleadd -u 5000 -g 10 -m -d /export/home/sdown sdown
# passwd sdown
# vi /etc/security/prof_attr
Shut:::Able to shutdown the system:
# rolemod -P Shut,All sdown
# more /etc/user_attr
# useradd -u 4009 -g 10 -m -d /export/home/user9 -s /bin/ksh \
-R sdown user9
# passwd user9
# grep user9 /etc/user_attr
# vi /etc/security/exec_attr
Shut:suser:cmd:::/usr/sbin/shutdown:uid=0

stevens_wu

谢谢楼上的提示，发现了系统已经定义了关机的profile了。
只要增加一个角色shutrole，并把该角色的profile设置为Maintenance and Repair
#rolemod -P "Maintenance and Repair" shutrole
#useradd -m -d /export/home/test -R shutrole test
#passwd shutrole
#passwd test
重启一下，使用test登录
$su shutrole
$poweroff
就可以关机了