Hi,

I want to give privilege to a user in solaris9, for printer management

I tried smc - users -user account
added the right
Printer Management.
It doesn't work
What I have to do
Plz help.

are you talking about setting up rbac?

man roleadd

check out /etc/user_attr and the /etc/security/prof_attr and exec_attr

Sir,

rbac?. I'm not familiar with the terminology.

In etc/user_attr, following line is there

user1:::rofiles=Printer Management;type=normal.

In /etc/security/exec_attr
Can I modify the lines starting with "Printer Management"

rbac=role base access control

2 files deal with printer management...

prof_attr specifies the name of the profile with a comment next to it

exec_attr will have lines like

printer management:suser:cmd:::/usr/sbin/enable:euid=lp

that means that if you associate the profile printer management to a user or to a role, then in this case, you can use the enable command.

Note: There are several lines in exec_attr with the individual commands that you can use with the profile "printer management".

Ex: you should be able to use enable, lprm, lpshut, accept, lpset, lpadmin and so forth.

Yes I noticed it.
printer management:suser:cmd:::/usr/sbin/enable:euid=lp

My doubt is, can I suffix the string ":euid=user1"
to each such line. Any problem?

Is there any easy way?

I tried it with smc first.
Why these entries are not coming in the concerned files, as I use smc?
Was my procedure not correct?

Hi AJ:

You seem to be missing the boat here. The idea here is that the exec_attr speficies which commands can be executed by which profile. The euid=0 tells the system that you are effectively running this as user id # 0 (root). If you change it to euid=user1, then the end result will be (odds are, havent't tried it) permission denied (probably)

By the way, go through the forum and you will see an example on how to set up from scratch that I posted a few days ago.

Thanks javier,
I've seen it.
Before I try it , I have a doubt.
As mentioned earlier, How can I do the same using smc?

yes, you can use smc to create rbac but it is much faster to do it cli style. smc takes too long for my taste.