1

I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is Linux.

  • Do we talk about Solaris? Or BSD, linux....? – Romeo Ninov Aug 31 '16 at 14:06
  • Linux doesn't user capabilities, but file permissions, and possibly additional ACLs if that's set up. AFAIK you have to check to see what files the process attempts to access, and set up the permissions accordingly. – gardenhead Aug 31 '16 at 22:57
  • @gardenhead, o rly, no capabilities? man7.org/linux/man-pages/man7/capabilities.7.html :) – crashtua Sep 3 '16 at 7:22
0

As gardenhead mentioned, you can't really tell without knowing exactly what a process is going to do. You still have some viable options that aren't too much of a hassle:

OPTION 1

Create a new group (e.g., zfsgroup), add the users that need access to this command to the group, and add a sudoers entry like %zfsgroup ALL = (ALL) NOPASSWD: /path/to/zpool, which will allow users in the zfsgroup to run zpool commands without a password prompt. Among other things, you can also explicitly define subcommands allowed or disallowed (e.g., by adding to the above , !/path/to/zpool destroy * all zpool commands are allowed except for destroy). Refer to man sudoers for more information.

OPTION 2

zfs allow might be a better option, depending on your exact needs. Apparently, it allows you to set permissions (e.g., create,snapshot,etc.) for a specific user(s) on a target dataset(s), but they can only operate within the specified targets. Here is a good article on the subject: Delegating ZFS Permissions I am pretty sure that most of this applies to the Linux implementation, but check the manual. Just looking at zfs(8), I see some differences for the allow subcommand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.