> What does that mean for this project, though? If SCF isn't being > considered and this proposal goes forward with its limitation that all > libipadm consumers (except for ipadm) need to be setuid root [1], will > NWAM be able to use this? > > -Seb > > [1] I'm assuming that requiring consumers to be setuid ipadm is a > non-starter, as we must have an underlying assumption that consumers of > the API are doing more than calling libipadm functions. >
There is no need to have euid=0 for utilities which link into 'libipadm.so'. They just need to have the privilege of 'file_dac_write' with whatever 'euid'. Remember that the data store 'ipadm.conf' will be owned and writable by 'ipadm' user and not 'root'. While inside the library, without this privilege, it will not be possible to perform datastore operation and it will bail out with 'EPERM'. ~Girish
