I'm running a server process under SMF (Server Management Facility) on Joyent's Base64 1.8.1 SmartOS image.
For those not aqauinted with SmartOS, it is a cloud-based distribution of IllumOS with KVM. But essentially it is like Solaris
and inherits from OpenSolaris. So even if you've not used SmartOS, I'm hoping to tap into some Solaris knowledge on ServerFault.
My issue is that I want an unprivileged user to be allowed to restart a service that they own. I have worked out how to do that by using RBAC
and adding an authorisation to /etc/security/auth_attr
and associating that authorisation with my user.
I then added
the following to my SMF manifest for
the service:
<property_group name='general' type='framework'>
<!-- Allow to be restarted-->
<propval name='action_authorization' type='astring'
value='solaris.smf.manage.my-server-process' />
<!-- Allow to be started
and stopped -->
<propval name='value_authorization' type='astring'
value='solaris.smf.manage.my-server-process' />
</property_group>
And this works well when imported. My unprivileged user is allowed to restart, start
and stop its own server process (this is for automated code deployments).
However, if I export
the SMF manifest, this configuration data is gone... all I see in that section is this:
<property_group name='general' type='framework'>
<property name='action_authorization' type='astring'/>
<property name='value_authorization' type='astring'/>
</property_group>
Does anybody know why this is happening? Is my syntax wrong, or am I simply not using SMF incorrectly?
