Hide Controls from System Service
Hi Experts,
During customer project we want to hide controls of os system service. There is "access" keyword for <control> configuration. This parameter can set to PRIVATE or PROTECTED to control user acces to <control>s in the system service.
But we want to use one of this protected <control>s in a plan that is part of another plugin. We want to avoid that default users can execute system services directly. Users have only the right to use plan that access predefined <control>s and thier parameters.
Is there a chance to protect system services of "direct" use and only use <control>s in plans ?
Thanks for advice ....
Christian
[701 byte] By [
ChRa] at [2007-11-26 22:31:44]
# 1
Security through obscurity may not suit your needs, but, on the off chance it would, have you considered making your os system service controls not visible? It wouldn't stop them from being executed in any fashion, even directly from the UI, but it may help.
# 2
> Hi Experts,
>
> During customer project we want to hide controls of
> os system service. There is "access" keyword for
> <control> configuration. This parameter can set to
> PRIVATE or PROTECTED to control user acces to
> <control>s in the system service.
>
> But we want to use one of this protected <control>s
> in a plan that is part of another plugin. We want to
> avoid that default users can execute system services
> directly. Users have only the right to use plan that
> access predefined <control>s and thier parameters.
>
> Is there a chance to protect system services of
> "direct" use and only use <control>s in plans ?
A possibility is to use the autorun or "Run Component Procedures" permissions.
http://docs.sun.com/app/docs/doc/819-4450/6n6jp1i6p?a=view#fbljx
autorun permissions are checked when user attempts to run a component install / control / uninstall service through autogenerating the plan by clicking on the appropriate run button on the component details page.
You usually do not want to enable autorun permissions on system services because usually you'd want to grant execute permissions to all users / hosts for the system services to keep things simple, (although nothing prevents you from having more restrictive permissions on system services) but you wouldn't any logged in user to be able to run them directly.
hope this helps.
Aj
aj.a at 2007-7-10 11:37:30 >
