How to set role which can issue only one command

Question

I am thinking about setting role, which will be allowed to issue olny one command. I have created role test. Which has the following entries in the following files:
/etc/user_attr
test::::profiles=OneCommand;type=role
/etc/security/exec_attr
OneCommand:solaris:cmd:::/tmp/data.sh:euid=0
After this I sill could issue all comands, not only test command /tmp/data.sh.
When I issued comand profiles on test role I received the following:
bash-3.00$ profiles test
OneCommand
Basic Solaris User
All
So I commented line in the /etc/policy.conf to read:
#PROFS_GRANTED=Basic Solaris User
After that, when I try to issue /tmp/data.sh command as a test role I receive the following error:
$ /tmp/data.sh
pfexec: Exec format error
Does anybody know how to set up the role which can issue only one command ? Maybe there is a way to do this in the way which wil not affect another roles (ie, not to touch /etc/policy.conf).
Best regards

Answer 1

RadekW wrote:
I am thinking about setting role, which will be allowed to issue olny one command. I have created role test. Which has the following entries in the following files:They will need the ability to run at least a profile shell otherwise all bets are off. So now you're down to two commands. :-)
bash-3.00$ profiles test
OneCommand
Basic Solaris User
AllFirst you need to define what already exists by default. (policy.conf)
Then you get to change those defaults or create a new default list just for test.
Then you get to add a role or profile for test that allows the execution of a profile shell and one command.
Then you should test all of the user accounts to ensure that something didn't break. This step might be a little overkill.
alan