TSM AIX admin restrictions -- restore some files, and not others?

[jaybee]

Access to root account is restricted. How can we allow TSM admins to restore files in some filesystems (with original ownership and permissions), and not to restore files in sys filesystems (/var ...) ... with a TSM admin account, and without root?



I don't think this can be done with TSM 5.2 native. I could be wrong? Maybe you all know of a third party solution?

 

[Craigy]

Hm.



You want another user than root (for example, user joe) to be able to recover files owned by all users, presumably including root.



Now, if joe is allowed to use "dsmc restore" to create a file owned by root (or any other user), what's to stop him using that recoevry process to create a file woned by and run by root that chanegs the permissions of the users to allow him access to everything on the system, including the users/groups files?



That's why TSM is set up in this way.



On the other hand, what you *could* do is set up a recovery system that runs in a restricted shell, so while the TSM admins have access to recover things already in TSM they would be restricted as to what they could do with that.



The hassle in doing this is why most shops just allow TSM to run as root.



Craigy