Return
-
Title
Use of pmless for providing directory access -
Description
For example there may be requests from users who need to be able to read specific log files owned by root. Pmless typically requires a full path for the file to be read. How can the policy be configured to allow a specific user access to log files contained within a specific directory? -
Resolution
The profileBasedPolicy uses the glob() function to compare the arguments in the actual command against arguments specified in pf_commands, so it should be possible to use wildcards in pf_commands to specify the directories in which the log files are located.
For example:
pm_commands={
"pmless /var/log/*",
"pmless /var/opt/myapp/*",
}would allow running "pmrun pmless" on any of the log files in the /var/log or /var/opt/myapp directories.