docs(policy): document Unix group rules

docs/source/guides/admin-guides/references/man5/policy.5.rst

@@ -44,7 +44,7 @@ policy Attributes:
 
 \ **name**\ 
  
- The username that is allowed to perform the commands specified by this rule.  Default is "\*" (all users).
+ The username that is allowed to perform the commands specified by this rule. Prefix a name with "%" to match a Unix group, for example "%xCATEng". Primary and supplementary group membership is resolved through the system group database on the xcatd host evaluating the request. Default is "\*" (all users).
  
 
 
@@ -80,7 +80,7 @@ policy Attributes:
 
 \ **rule**\ 
  
- Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question.  This authorization should only be given to the xcatd on the management node at this time.
+ Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question. Trusted identity handling requires an exact username rule; a Unix group rule can authorize commands but cannot grant trusted identity handling. This authorization should only be given to the xcatd on the management node at this time.
  
 
 

docs/source/guides/admin-guides/references/man7/policy.7.rst

@@ -53,7 +53,7 @@ policy Attributes:
 
 \ **name**\  (policy.name)
  
- The username that is allowed to perform the commands specified by this rule.  Default is "\*" (all users).
+ The username that is allowed to perform the commands specified by this rule. Prefix a name with "%" to match a Unix group, for example "%xCATEng". Primary and supplementary group membership is resolved through the system group database on the xcatd host evaluating the request. Default is "\*" (all users).
  
 
 
@@ -77,7 +77,7 @@ policy Attributes:
 
 \ **rule**\  (policy.rule)
  
- Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question.  This authorization should only be given to the xcatd on the management node at this time.
+ Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question. Trusted identity handling requires an exact username rule; a Unix group rule can authorize commands but cannot grant trusted identity handling. This authorization should only be given to the xcatd on the management node at this time.
  
 
 

perl-xCAT/xCAT/Schema.pm

@@ -891,13 +891,13 @@ passed as argument rather than by table value',
         table_desc => 'The policy table in the xCAT database controls who has authority to run specific xCAT operations. It is basically the Access Control List (ACL) for xCAT. It is sorted on the priority field before evaluating.',
         descriptions => {
             priority => 'The priority value for this rule.  This value is used to identify this policy data object (i.e. this rule) The table is sorted on this field with the lower the number the higher the priority. For example 1.0 is higher priority than 4.1 is higher than 4.9.',
-            name => 'The username that is allowed to perform the commands specified by this rule.  Default is "*" (all users).',
+            name => "The username that is allowed to perform the commands specified by this rule. Prefix a name with \"%\" to match a Unix group, for example \"%xCATEng\". Primary and supplementary group membership is resolved through the system group database on the xcatd host evaluating the request. Default is \"*\" (all users).",
             host => 'The host from which users may issue the commands specified by this rule.  Default is "*" (all hosts). Only all or one host is supported',
             commands => 'The list of commands that this rule applies to.  Default is "*" (all commands).',
             noderange => 'The Noderange that this rule applies to.  Default is "*" (all nodes). Not supported with the *def commands.',
             parameters => 'A regular expression that matches the command parameters (everything except the noderange) that this rule applies to.  Default is "*" (all parameters). Not supported with the *def commands.',
             time => 'Time ranges that this command may be executed in.  This is not supported.',
-            rule => 'Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question.  This authorization should only be given to the xcatd on the management node at this time.',
+            rule => 'Specifies how this rule should be applied.  Valid values are: allow, trusted. Allow will allow the user to run the commands. Any other value will deny the user access to the commands. Trusted means that once this client has been authenticated via the certificate, all other information that is sent (e.g. the username) is believed without question. Trusted identity handling requires an exact username rule; a Unix group rule can authorize commands but cannot grant trusted identity handling. This authorization should only be given to the xcatd on the management node at this time.',
             comments => 'Any user-written notes.',
             disable  => "Set to 'yes' or '1' to comment out this row.",
         },