03-14-2019
Quote:
Originally Posted by
as7951
I have informed the same to customer and told that we can't limit the user until he has all the rights.
If you carefully re-read the posts above you will see that Corona688 already adressed that: instead of giving a user all rights (in fact that means he can become the root user, which is allowed to do everything) and then (try to) take away the rights you don't want him to have you should look at it differently from the start:
What does the user have to do and precisely which rights does he need for that?
Once you answered this question (not to me - to yourself) you can start thinking about ways to give the user exactly these rights - and nothing more. Instead of giving out all rights and then taking back some you only give out what is absolutely necessary in the first place.
If you tell us about your (long-term) goals - that is, what is the user account supposed to do - we can help you come up with ways to achieve that. It is perhaps possible to do it but just not in the way you tried.
I hope this helps.
bakunin
Last edited by bakunin; 03-14-2019 at 01:15 PM..
This User Gave Thanks to bakunin For This Post:
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I need to set up/modify a user account on one of our machines which will allow the user to stay on the system, but not use their user id and password to login to the machine. It is for the purposes of an ftp user, so that nobody can then login as ftp/passwd. Ta.:) (2 Replies)
Discussion started by: danhodges99
2 Replies
2. AIX
Hi all,
I am a newbe to aix 5.2. I want to specify the characters used by users while creating user in aix like specifying the length of the password
should i use some sript for that if it is then please let me know how to do this
if yes give me the link for the scripts.
Thanks in advance
... (2 Replies)
Discussion started by: Satya Mishra
2 Replies
3. UNIX for Dummies Questions & Answers
I created a user, i login as a root. I add him in the group where he can access and login as a root! I checked it in users' list and in group's list, he is there. My problem is this, I cant login using the username/account I just created! What should i do to use and login the user/account i've just... (5 Replies)
Discussion started by: jerome
5 Replies
4. Shell Programming and Scripting
Hi,
My requirement is that i am login from ROOT in a script but when any
command is coming which is logging to sqlplus then i have to run it with normal user as only normal user have permission to connect to sqlplus .
i tried making a script like this :
#! /bin/ksh
su -... (3 Replies)
Discussion started by: rawatds
3 Replies
5. Cybersecurity
Dears
I want to prevent users from doing spesific command "history -c" or "history" in general
How can I do ? (4 Replies)
Discussion started by: reaky
4 Replies
6. IP Networking
hi all,
i want to prevent users downloading files in the office as bandwidth becomes very low
and affects work.
one of my friend tried to close the connection using ethercap but this does not work.
i have a debian desktop while other users use MS W!ndows.
Please provide any help. Thanks (5 Replies)
Discussion started by: coolatt
5 Replies
7. Shell Programming and Scripting
Hi Every body,
I would need a shell script program to login as different user and perform some copy commands in the script.
example: Supppose ora_toms is the active user
ora_toms should be able to run a script where user: ftptomsp pass: XXX should login through and run the commands
... (9 Replies)
Discussion started by: ujjwal27
9 Replies
8. Shell Programming and Scripting
now i have logged in username : ramesh in unix
Now i have to created script file to login into another user and have run a command inside that user and after executing the command i have to exit from that user.
Inside script, i have to login into su - ram along with password : haihow and have to... (4 Replies)
Discussion started by: rammm
4 Replies
9. Shell Programming and Scripting
Hi could some let me know how to prevent user from changing his home directory.......
Thanks in advance.... (1 Reply)
Discussion started by: Revanth547
1 Replies
10. Shell Programming and Scripting
Hi could some let me know how to prevent user from changing his home directory.......
Thanks in advance.... (6 Replies)
Discussion started by: rahul547
6 Replies
LEARN ABOUT FREEBSD
cap_rights_clear
CAP_RIGHTS_INIT(3) BSD Library Functions Manual CAP_RIGHTS_INIT(3)
NAME
cap_rights_init, cap_rights_set, cap_rights_clear, cap_rights_is_set, cap_rights_is_valid, cap_rights_merge, cap_rights_remove,
cap_rights_contains -- manage cap_rights_t structure
LIBRARY
Standard C Library (libc, -lc)
SYNOPSIS
#include <sys/capsicum.h>
cap_rights_t *
cap_rights_init(cap_rights_t *rights, ...);
cap_rights_t *
cap_rights_set(cap_rights_t *rights, ...);
cap_rights_t *
cap_rights_clear(cap_rights_t *rights, ...);
bool
cap_rights_is_set(const cap_rights_t *rights, ...);
bool
cap_rights_is_valid(const cap_rights_t *rights);
cap_rights_t *
cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
cap_rights_t *
cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
bool
cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);
DESCRIPTION
The functions documented here allow to manage the cap_rights_t structure.
Capability rights should be separated with comma when passed to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and
cap_rights_is_set() functions. For example:
cap_rights_set(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT, CAP_SEEK);
The complete list of the capability rights can be found in the rights(4) manual page.
The cap_rights_init() function initialize provided cap_rights_t structure. Only properly initialized structure can be passed to the remain-
ing functions. For convenience the structure can be filled with capability rights instead of calling the cap_rights_set() function later.
For even more convenience pointer to the given structure is returned, so it can be directly passed to cap_rights_limit(2):
cap_rights_t rights;
if (cap_rights_limit(fd, cap_rights_init(&rights, CAP_READ, CAP_WRITE)) < 0)
err(1, "Unable to limit capability rights");
The cap_rights_set() function adds the given capability rights to the given cap_rights_t structure.
The cap_rights_clear() function removes the given capability rights from the given cap_rights_t structure.
The cap_rights_is_set() function checks if all the given capability rights are set for the given cap_rights_t structure.
The cap_rights_is_valid() function verifies if the given cap_rights_t structure is valid.
The cap_rights_merge() function merges all capability rights present in the src structure into the dst structure.
The cap_rights_remove() function removes all capability rights present in the src structure from the dst structure.
The cap_rights_contains() function checks if the big structure contains all capability rights present in the little structure.
RETURN VALUES
The functions never fail. In case an invalid capability right or an invalid cap_rights_t structure is given as an argument, the program will
be aborted.
The cap_rights_init(), cap_rights_set() and cap_rights_clear() functions return pointer to the cap_rights_t structure given in the rights
argument.
The cap_rights_merge() and cap_rights_remove() functions return pointer to the cap_rights_t structure given in the dst argument.
The cap_rights_is_set() returns true if all the given capability rights are set in the rights argument.
The cap_rights_is_valid() function performs various checks to see if the given cap_rights_t structure is valid and returns true if it is.
The cap_rights_contains() function returns true if all capability rights set in the little structure are also present in the big structure.
EXAMPLES
The following example demonstrates how to prepare a cap_rights_t structure to be passed to the cap_rights_limit(2) system call.
cap_rights_t rights;
int fd;
fd = open("/tmp/foo", O_RDWR);
if (fd < 0)
err(1, "open() failed");
cap_rights_init(&rights, CAP_FSTAT, CAP_READ);
if (allow_write_and_seek)
cap_rights_set(&rights, CAP_WRITE, CAP_SEEK);
if (dont_allow_seek)
cap_rights_clear(&rights, CAP_SEEK);
if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS)
err(1, "cap_rights_limit() failed");
SEE ALSO
cap_rights_limit(2), open(2), capsicum(4), rights(4)
HISTORY
Support for capabilities and capabilities mode was developed as part of the TrustedBSD Project.
AUTHORS
This family of functions was created by Pawel Jakub Dawidek <pawel@dawidek.net> under sponsorship from the FreeBSD Foundation.
BSD
March 27, 2014 BSD