From owner-freebsd-stable@FreeBSD.ORG Sat Apr 28 09:48:02 2012 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 5F1A31065674; Sat, 28 Apr 2012 09:48:02 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from mail.zoral.com.ua (mx0.zoral.com.ua [91.193.166.200]) by mx1.freebsd.org (Postfix) with ESMTP id CBE498FC0C; Sat, 28 Apr 2012 09:48:01 +0000 (UTC) Received: from skuns.kiev.zoral.com.ua (localhost [127.0.0.1]) by mail.zoral.com.ua (8.14.2/8.14.2) with ESMTP id q3S9ln5e026593; Sat, 28 Apr 2012 12:47:49 +0300 (EEST) (envelope-from kostikbel@gmail.com) Received: from deviant.kiev.zoral.com.ua (kostik@localhost [127.0.0.1]) by deviant.kiev.zoral.com.ua (8.14.5/8.14.5) with ESMTP id q3S9lnjw092034; Sat, 28 Apr 2012 12:47:49 +0300 (EEST) (envelope-from kostikbel@gmail.com) Received: (from kostik@localhost) by deviant.kiev.zoral.com.ua (8.14.5/8.14.5/Submit) id q3S9lnHs092033; Sat, 28 Apr 2012 12:47:49 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: deviant.kiev.zoral.com.ua: kostik set sender to kostikbel@gmail.com using -f Date: Sat, 28 Apr 2012 12:47:49 +0300 From: Konstantin Belousov To: Dimitry Andric Message-ID: <20120428094749.GF2358@deviant.kiev.zoral.com.ua> References: <4F9BB896.8040005@FreeBSD.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="htO1hhWexm+U+1ye" Content-Disposition: inline In-Reply-To: <4F9BB896.8040005@FreeBSD.org> User-Agent: Mutt/1.4.2.3i X-Virus-Scanned: clamav-milter 0.95.2 at skuns.kiev.zoral.com.ua X-Virus-Status: Clean X-Spam-Status: No, score=-4.0 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on skuns.kiev.zoral.com.ua Cc: Zenny , "freebsd-stable@freebsd.org" Subject: Re: Restricting users from certain privileges X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Apr 2012 09:48:02 -0000 --htO1hhWexm+U+1ye Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Apr 28, 2012 at 11:29:58AM +0200, Dimitry Andric wrote: > On 2012-04-28 09:50, Zenny wrote: > > On Sat, Apr 28, 2012 at 9:38 AM, Daniel Braniss w= rote: > ... > >> try sudo from ports, security/sudo > > Thanks Daniel, but sudo gives all (not selective) root privileges to the > > user (admin in my case). >=20 > This isn't true. With sudo, you can give specific users, or groups of > users, restricted lists of commands they can run, and even specify on > which particular machines they can be run. Sure, but if the allowed commands were not specifically designed to be run with elevated privileges, you typically give the user ability to run any command with elevated privileges. Even specially designed commands sometimes give away much more power then intended. --htO1hhWexm+U+1ye Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (FreeBSD) iEYEARECAAYFAk+bvMQACgkQC3+MBN1Mb4hWuwCfX4mbiqM8unepiC2FukO+FyUW 7J0AoO+QB5Bw2dokA9pdVXHhRIIkpupy =7IlQ -----END PGP SIGNATURE----- --htO1hhWexm+U+1ye--