I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is Linux.
As gardenhead mentioned, you can't really tell without knowing exactly what a process is going to do. You still have some viable options that aren't too much of a hassle:
Create a new group (e.g.,
zfsgroup), add the users that need access to this command to the group, and add a sudoers entry like
%zfsgroup ALL = (ALL) NOPASSWD: /path/to/zpool, which will allow users in the
zfsgroup to run zpool commands without a password prompt. Among other things, you can also explicitly define subcommands allowed or disallowed (e.g., by adding to the above
, !/path/to/zpool destroy * all zpool commands are allowed except for destroy). Refer to
man sudoers for more information.
zfs allow might be a better option, depending on your exact needs. Apparently, it allows you to set permissions (e.g., create,snapshot,etc.) for a specific user(s) on a target dataset(s), but they can only operate within the specified targets. Here is a good article on the subject: Delegating ZFS Permissions I am pretty sure that most of this applies to the Linux implementation, but check the manual. Just looking at zfs(8), I see some differences for the allow subcommand.