Sponsored Content
Operating Systems Solaris Grant unprivileged user rights to see the output of echo|format but not modify disks Post 302955133 by Corona688 on Monday 14th of September 2015 06:28:05 PM
Old 09-14-2015
Granting access to a specific command in a very exact way is the sort of thing I'd use sudo for. A script that does exactly what you want, which you can grant access to specifically.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

How to enable ifconfig to unprivileged user?

Hello, everyone. I have installed Red Hat 9.0 and Mandrake 9.1 on my computer. I could use a unprivileged user account to run "ifconfig" directly. But when I was using Red Hat, either root or other accounts could run "ifconfig" --- the error messege said: "bash: ifconfig: command not found". I... (5 Replies)
Discussion started by: HOUSCOUS
5 Replies

2. UNIX for Dummies Questions & Answers

filesystem monitor, for unprivileged user

how can i, ordinary, not a privileged user, monitor my part of filesystem ($HOME dir), to see (at least in log) when and which files was created/deleted/moved ? (I heard something abound "sandbox", but i don`t need to restrict applications, i just want to log its actions) p.s. my system is... (0 Replies)
Discussion started by: variety
0 Replies

3. HP-UX

User rights

I wan to create a user e.g. Tom. whenever a file is created by user Tom or FTP is done using user as Tom, the rights on the file should be 777 (by default). how can I achieve this. Please help. Its very urgent. (1 Reply)
Discussion started by: sharmavr
1 Replies

4. Linux

grant root privileges to ordinary user

Hi, Is it possible to grant root privileges to an ordinary user? Other than 'sudo', is there some way under Users/Groups configuration? I want ordinary user to be able to mount, umount and use command mt. /Brendan (4 Replies)
Discussion started by: brendan76
4 Replies

5. UNIX for Dummies Questions & Answers

Format output from "echo" command

Hi, I have written a BASH shell script that contains a lot of "echo" commands to notify the user about what's going on. The script generates a log file that contains a copy of what is seen in the terminal. The echo statements are generally verbose, and thus extend out for quite a ways on one... (2 Replies)
Discussion started by: msb65
2 Replies

6. Shell Programming and Scripting

Modify a perl line to parse out and output to another format

Hey there... I am looking for a way to take the below contents ( small excerpt) of this file called PTR.csv ptrrecord,0000002e0cc0.homeoffice.anfcorp.com,,10.11.191.62,,,False,62.191.11.10.in-addr.arpa,,302400,default... (6 Replies)
Discussion started by: richsark
6 Replies

7. Shell Programming and Scripting

modify ls -l (long listing format output) strictly using SED only straightforward goalhard 4 me doh

Below is a sample out of ls -l which I would like to rearrange or modify by field numbers for example I successfully managed to disect using simple paragraph however for ls -l I can't divide the rows or fields by field number. Successful modification by fields using SED sample: $ sed -e... (1 Reply)
Discussion started by: wolf@=NK
1 Replies

8. Shell Programming and Scripting

How to grep the grant statement and output to the different files?

Hi currently I have a list of *.sql files. one of the file, terminal is Prompt Table TERMINAL; CREATE TABLE TERMINAL ( TERMINAL_ID NUMBER(8), EXCEL_TERMINAL_ID NUMBER(8), MERCHANT_ID NUMBER(8), SETTLE_TIME VARCHAR2(4 CHAR) ); COMMENT... (4 Replies)
Discussion started by: jediwannabe
4 Replies

9. UNIX for Beginners Questions & Answers

Solaris, grant user to kill another process

the task is grant user1 to kill another (for example user2) process. My steps: by root: usermod -P "Process Management" user1 login user1 user1@server (~) pfexec kill <PID> the result is: ksh: <PID>: not found or user1@server (~) pfexec pkill <PID> the result: nothing happens, still... (0 Replies)
Discussion started by: dsyberia
0 Replies

10. AIX

Unable to set ACLs on sulog - need to grant read permission to a normal user on AIX 6.1

Hi, I need to grant read permission to a normal user on sulog file on AIX 6.1. As root I did acledit sulog and aclget shows "extended permissions" as "enabled" and normal user "splunk" has read permissions. When I try to access sulog as splunk user it won't allow and aclget for splunk user... (6 Replies)
Discussion started by: prvnrk
6 Replies
auth_attr(4)							   File Formats 						      auth_attr(4)

NAME
auth_attr - authorization description database SYNOPSIS
/etc/security/auth_attr DESCRIPTION
/etc/security/auth_attr is a local source for authorization names and descriptions. The auth_attr file can be used with other authorization sources, including the auth_attr NIS map and NIS+ table. Programs use the getauthattr(3SECDB) routines to access this information. The search order for multiple authorization sources is specified in the /etc/nsswitch.conf file, as described in the nsswitch.conf(4) man page. An authorization is a right assigned to users that is checked by certain privileged programs to determine whether users can execute restricted functionality. Each entry in the auth_attr database consists of one line of text containing six fields separated by colons (:). Line continuations using the backslash () character are permitted. The format of each entry is: name:res1:res2:short_desc:long_desc:attr name The name of the authorization. Authorization names are unique strings. Construct authorization names using the following convention: prefix. or prefix.suffix prefix Everything in the name field up to the final dot (.). Authorizations from Sun Microsystems, Inc. use solaris as a prefix. To avoid name conflicts, all other authorizations should use a prefix that begins with the reverse-order Internet domain name of the organization that creates the authorization (for example, com.xyzcompany). Prefixes can have additional arbitrary components chosen by the authorization's developer, with components separated by dots. suffix The final component in the name field. Specifies what is being authorized. When there is no suffix, the name is defined as a heading. Headings are not assigned to users but are constructed for use by applications in their GUIs. When a name ends with the word grant, the entry defines a grant authorization. Grant authorizations are used to support fine-grained delegation. Users with appropriate grant authorizations can delegate some of their authorizations to others. To assign an authorization, the user needs to have both the authorization itself and the appropriate grant authorization. res1 Reserved for future use. res2 Reserved for future use. short_desc A short description or terse name for the authorization. This name should be suitable for displaying in user interfaces, such as in a scrolling list in a GUI. long_desc A long description. This field can explain the precise purpose of the authorization, the applications in which it is used, and the type of user that would be interested in using it. The long description can be displayed in the help text of an application. attr An optional list of semicolon-separated (;) key-value pairs that describe the attributes of an authorization. Zero or more keys may be specified. The keyword help identifies a help file in HTML. EXAMPLES
Example 1: Constructing a Name In the following example, the name has a prefix (solaris.admin.usermgr) followed by a suffix (read): solaris.admin.usermgr.read Example 2: Defining a Heading Because the name field ends with a dot, the following entry defines a heading: solaris.admin.usermgr.:::User Accounts::help=AuthUsermgrHeader.html Example 3: Assigning Separate Authorizations to Set User Attributes In this example, a heading entry is followed by other associated authorization entries. The entries below the heading provide separate authorizations for setting user attributes. The attr field for each entry, including the heading entry, assigns a help file. The applica- tion that uses the help key requires the value to equal the name of a file ending in .htm or .html: solaris.admin.usermgr.:::User Accounts::help=AuthUsermgrHeader.html solaris.admin.usermgr.pswd:::Change Password::help=AuthUserMgrPswd.html solaris.admin.usermgr.write:::Manage Users::help=AuthUsermgrWrite.html Example 4: Assigning a Grant Authorization This example assigns to an administrator the following authorizations: solaris.admin.printer.grant solaris.admin.printer.delete solaris.admin.printer.modify solaris.admin.printer.read solaris.login.enable With the above authorizations, the administrator can assign to others the solaris.admin.printer.delete, solaris.admin.printer.modify, and solaris.admin.printer.read authorizations, but not the solaris.login.enable authorization. If the administrator has both the grant autho- rization, solaris.admin.printmgr.grant, and the wildcard authorization, solaris.admin.printmgr.*, the administrator can grant to others any of the printer authorizations. See user_attr(4) for more information about how wildcards can be used to assign multiple authorizations whose names begin with the same components. Example 5: Authorizing the Ability to Assign Other Authorizations The following entry defines an authorization that grants the ability to assign any authorization created with a solaris prefix, when the administrator also has either the specific authorization being granted or a matching wildcard entry: solaris.grant:::Grant All Solaris Authorizations::help=PriAdmin.html Example 6: Consulting the Local Authorization File Ahead of the NIS Table With the following entry from /etc/nsswitch.conf, the local auth_attr file is consulted before the NIS table: auth_attr:files nisplus FILES
/etc/nsswitch.conf /etc/user_attr /etc/security/auth_attr SEE ALSO
getauthattr(3SECDB), getexecattr(3SECDB), getprofattr(3SECDB), getuserattr(3SECDB), exec_attr(4), nsswitch.conf(4), user_attr(4) NOTES
When deciding which authorization source to use, keep in mind that NIS+ provides stronger authentication than NIS. Because the list of legal keys is likely to expand, any code that parses this database must be written to ignore unknown key-value pairs without error. When any new keywords are created, the names should be prefixed with a unique string, such as the company's stock symbol, to avoid potential naming conflicts. Each application has its own requirements for whether the help value must be a relative pathname ending with a filename or the name of a file. The only known requirement is for the name of a file. The following characters are used in describing the database format and must be escaped with a backslash if used as data: colon (:), semi- colon (;), equals (=), and backslash (). SunOS 5.10 9 Jan 2002 auth_attr(4)
All times are GMT -4. The time now is 06:23 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy