Note that you (may) need to logout and login again for the new priviledges to take effect. The preferred approach might be to create a new administrative role, `rtsj_role', then assign `Java Real-Time System User' right to `rtsj_role', and make the user who want to use Java RTS assumes the rtsj_role.
The following procedures are quoted from /opt/SUNWrtjv/doc/JavaRTSInstallation.html#privileges
Granting Privileges to Java RTS Users
The Java Real-Time System uses a number of Solaris resources, such as the real-time scheduling class, whose usage is restricted to privileged processes. Therefore, the Java RTS Virtual Machine must be run as the superuser (root) or must be explicitly granted additional rights by the system administrator in order to ensure predictable timing of operations.
Solaris supports role-based access control (RBAC), which enforces security policy at a more fine-grained level than the conventional superuser security model. This enables a user to be assigned the precise level of privilege that is necessary to execute the Java RTS.
This is typically achieved by means of a specific rights profile, that is, a collection of commands with security attributes. Rights profiles are usually included in an administrative role, and the role is then assigned to a user. Direct assignment of rights profiles to a user is also possible. In that latter case, this user must use a profile shell such as pfsh(1) or pfcsh(1) for the commands with security attributes to succeed.
Rights profiles can be managed using the Solaris Management Console, smc(1), a graphical user interface that provides access to Solaris system administration tools.
To invoke the Solaris Management Console, type the following command:
# /usr/sbin/smc
The 'Java Real-Time System User' rights profile can also be assigned to an administrative role using the following command:
# /usr/sbin/rolemod -P "Java Real-Time System User"
where is an existing role account.
This rights profile can also be directly assigned to a Solaris user by using:
# /usr/sbin/usermod -P "Java Real-Time System User"
where is an existing, local user name.
Alternatively, you can decide not to use the Java RTS profile and assign additional rights directly to the Java RTS users. In that later case, be aware that all the processes created by such Java RTS users (that is, not only the Java RTS Virtual Machine) will be granted these additional rights.
Rights management is implemented on Solaris through privileges, that is, discrete rights required to perform particular operations. Privileges decrease the security risk that is associated with one user or one process having full superuser capabilities on a system.
If you decide to bypass the Java RTS rights profile, then the Java RTS users must be granted at least the following privileges, for them to be able to run properly the Java RTS Virtual Machine:
- sys_res_config: allows a process to create and delete processor sets, assign CPUs to processor sets, and change the operational status of CPUs in the system.
- proc_priocntl: allows a process to elevate its priority above its current level and change its scheduling class to any scheduling class, including the RT class.
- proc_lock_memory: allows a process to lock pages in physical memory.
- proc_clock_highres: allows a process to use high resolution timers.
To assign the above set of privileges directly to a Java RTS user, use the Solaris Management Console, smc(1), or type the following command:
# /usr/sbin/usermod -K \
defaultpriv=basic,sys_res_config,proc_priocntl,proc_lock_memory,proc_clock_highres
where is an existing, local user name.
Note that the usermod(1M) command does not allow privileges to be assigned to non-local users (that is, to users who do not appear in the local /etc/passwd file). To assign privileges to a non-local user, add the following line to the /etc/user_attr file:
::::type=normal;profiles=Basic Solaris User;defaultpriv=basic,
sys_res_config,proc_priocntl,proc_lock_memory,proc_clock_highres
where is an existing, non-local user name.
