Hello, On Tue, 2007-11-20 at 13:16 -0600, Shawn Walker wrote: > While being able to "pfexec whatever" is convenient; it seems like I'm > essentially just given the ability to "run as a fully-privileged user" > anytime I want.
that is exactly what i miss in rbac. I normaly still use sudo instead, because of this missing password verification. I would like to see options in user_attr that allows to configure a password verification every time a user try to acquire privileges from its permitted set to its effective set. It might also be usefull to configure the duration of this password verificaltion. Imagine something like this: jack::askpw=user;timeout=300::profiles=Primary Administrator;roles=root BTW: I'm missing a Reply-To header for the OpenSolaris mailing lists _______________________________________________ indiana-discuss mailing list [email protected] http://mail.opensolaris.org/mailman/listinfo/indiana-discuss
