分类:
2008-05-27 10:03:19
Solaris的pfexec等命令比较奇怪,没搞明白如何使用,看了看原来是一套新的权限管理系统,能够更细粒度的控制用户权限。
其发展的一个主要原因是使用这套系统,那么就可以取消os的自带命令置suid位。
比如想让test用户执行/usr/bin/sh时,权限是uid=0 euid=0,那么我们可以使用如下控制策略
在/etc/user_attr中添加: test::::type=normal;auths=solaris.*,solaris.grant;profiles=ATestProfile 在/etc/security/exec_attr中添加: ATestProfile:suser:cmd:::/usr/bin/sh:uid=0;euid=0 |
bash-2.03$ id uid=1022(test) gid=1(other) bash-2.03$ pfexec /usr/bin/sh # id uid=0(root) gid=1(other) # |
bash-2.03$ cat exec_attr All:suser:cmd:::*: Audit Control:suser:cmd:::/etc/init.d/audit:euid=0;egid=3 Audit Control:suser:cmd:::/etc/security/bsmconv:uid=0 Audit Control:suser:cmd:::/etc/security/bsmunconv:uid=0 Audit Control:suser:cmd:::/usr/sbin/audit:euid=0 Audit Control:suser:cmd:::/usr/sbin/auditconfig:euid=0 Audit Control:suser:cmd:::/usr/sbin/auditd:uid=0 Audit Review:suser:cmd:::/usr/sbin/auditreduce:euid=0 Audit Review:suser:cmd:::/usr/sbin/praudit:euid=0 Audit Review:suser:cmd:::/usr/sbin/auditstat:euid=0 |
PROG=bsmconv STARTUP=/etc/security/audit_startup DEVALLOC=/etc/security/device_allocate DEVMAPS=/etc/security/device_maps TEXTDOMAIN="SUNW_OST_OSCMD" export TEXTDOMAIN permission() { WHO=`id | cut -f1 -d" "` # <-----------看看这里 if [ ! "$WHO" = "uid=0(root)" ] then form=`gettext "%s: ERROR: you must be super-user to run this script."` printf "${form}\n" $PROG exit 1 fi |
不过好在系统默认user_attr里只有一行,
root::::type=normal;auths=solaris.*,solaris.grant;profiles=All |