NetNews Usenet Archive 1992 #26/NN_1992_26.iso/spool/comp/sys/sgi/16029

Text File | 1992-11-06 | 2.6 KB | 58 lines

Newsgroups: comp.sys.sgi
Path: sparky!uunet!ukma!usenet.ins.cwru.edu!magnus.acs.ohio-state.edu!csn!news.den.mmc.com!enterprise.den.mmc.com!beck
From: [e-mail] (Fred R. Beck)
Subject: Re: 'control' program
Message-ID: <[e-mail]>
Sender: [e-mail] (News)
Nntp-Posting-Host: gate-enterprise.den.mmc.com
Organization: Martin Marietta
References:  <[e-mail]>
Date: Thu, 5 Nov 1992 17:44:34 GMT
Lines: 45

In article <[e-mail]>, [e-mail] (Peter Jaspers-Fayer) writes:
|>
|> We have a system that is used by many people, some of whom are unthinking
|> or unknowlegeable enough to "trash" the system by submitting many
|> resource-intensive background jobs at once, and then leaving the city.  We
|> found the need to allow a "sub-administrator" the ability to stop (kill)
|> or pause user processes, without being "handed all the keys".  A userid
|> with root UID/GID and a restrictive "padded cell" .cshrc shell script was
|> considered, but in the end, we wrote it as a C program, to be installed as
|> a shell.  It can be used by root as well, and (in a restricted way) by
|> users (to restart - or even pause - their own jobs).
|>
|> The program effects the "pause" operation via blockproc(2), because we
|> found that to be more reliable than `kill -STOP`.  It disallows any action
|> against "system" processes, and logs actions via syslog(3B).  It makes use
|> of a lot of system calls/libraries that I fear may be Irix (and maybe even
|> Irix 4.05) specific.  The user interface is tty, nothing special.
|>
|> If anyone's interested, you could anonymous FTP osiris.cs.uoguelph.ca
|> (pub/local/catman/cat1/control.z, pub/pjf_src/control.ca)
|>
|> Discussions about the program are welcome, discussions about the political
|> correctness of hanging or killing some hapless user's process are not :-)
|> --
|>  /PJ      "You can't grep dead trees"
|>  [e-mail]
|>                              [e-mail]
|>      CRT emissions are physically addictive. (Shh!)
|>      [phone]x6309

I have been using a public domain (with some slight mods) program
called "sudo" (Super-User Do) to perform the above and many other
functions.  I can hand out whatever "keys" I want to whomever I want.

I encourage my "administrators-in-training" to use this always so that
I can see in a sudolog file what and when they did what they did.

Using sudo forces each user to verify who they are with their own passwd.
Errors of usage are reported immediately to root!

I will be willing to post this code (with man page) if anyone is
interested.

-fred
 [e-mail]