<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jan 7, 2014 at 5:16 PM, Jan Safranek <span dir="ltr"><<a href="mailto:jsafrane@redhat.com" target="_blank">jsafrane@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 01/03/2014 01:30 PM, Radek Novacek wrote:<br>
> I've noticed that we suggest our users that they should use the 'pegasus' user<br>
> for connection to pegasus, for example in the Quick Start Guide [1].<br>
><br>
> But the default pegasus configuration forbids non-privileged users to create<br>
> indication subscriptions. This affects the 'pegasus' user. When someone<br>
> connects to the pegasus using 'pegasus' user, he can't create any<br>
> subscription, unless it's explicitly allowed in the pegasus configuration:<br>
><br>
> (from man cimconfig):<br>
><br>
> enableSubscriptionsForNonprivilegedUsers<br>
><br>
> Description: If True, nonprivileged user of the system will be<br>
> allowed to create Indication Subscription, otherwise privileged access is<br>
> required.<br>
> Default Value: False<br>
> Dynamic: No<br>
><br>
><br>
> I think that this behavior is very confusing for our users, we should do one<br>
> of the following options:<br>
><br>
> 1) stick with current way - user must change that option in order to create<br>
> subscription as 'pegasus' (or other non-root) user and document it,<br>
><br>
> 2) allow 'pegasus' user to create indication subscriptions by default (don't<br>
> know if pegasus supports some kind of whitelisting of users),<br>
><br>
> 3) mark 'pegasus' user as privileged (not sure if possible),<br>
<br>
</div>Looking into sources, Pegasus checks for uid == 0, all other users are<br>
'unprivileged'.<br></blockquote><div>starting from pegasus 2.11.2 and 2.12 onwards, privileged users are users with gid == 0 or uid == 0<br></div><div>Details at [1] and [2]<br></div><div>Seems that you are using 2.11.0 or 2.11.1 or earlier versions of pegasus<br>
<br><br>[1] <a href="http://bugzilla.openpegasus.org/show_bug.cgi?id=9319">http://bugzilla.openpegasus.org/show_bug.cgi?id=9319</a><br>[2] <a href="http://bugzilla.openpegasus.org/show_bug.cgi?id=9334">http://bugzilla.openpegasus.org/show_bug.cgi?id=9334</a><br>
</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
<br>
<br>
</div><br>
<span class="HOEnZb"><font color="#888888"><br>
Jan<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
openlmi-devel mailing list<br>
<a href="mailto:openlmi-devel@lists.fedorahosted.org">openlmi-devel@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/openlmi-devel" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/openlmi-devel</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><div>Warm Regards<br>--Dev<br>OpenPegasus Developer/Committer<br><br><span>"Any fool can write code that a computer can understand. Good programmers write code that humans can understand."
<br>--- Martin Fowler</span>
<img src="http://cache-www.coderanch.com/templates/default/images/spacer.gif" alt="" width="1" height="1"><br></div></div>
</div></div>