2005-12-08 12:14:33 +00:00
|
|
|
=head1 NAME
|
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
fs setcell - Configures permissions for setuid programs from specified cells
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
B<fs setcell> B<-cell> <I<cell name>>+ [B<-suid>] [B<-nosuid>] [B<-help>]
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
B<fs setce> B<-c> <I<cell name>>+ [B<-s>] [B<-n>] [B<-h>]
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
The B<fs setcell> command sets whether the Cache Manager allows programs
|
|
|
|
(and other executable files) from each cell named by the B<-cell> argument
|
|
|
|
to run with setuid permission. By default, the Cache Manager allows
|
|
|
|
programs from its home cell to run with setuid permission, but not
|
|
|
|
programs from any foreign cells. A program belongs to the same cell as the
|
|
|
|
file server machine that houses the volume in which the program's binary
|
|
|
|
file resides, as specified in the file server machine's
|
|
|
|
F</usr/afs/etc/ThisCell> file. The Cache Manager determines its own home
|
|
|
|
cell by reading the F</usr/vice/etc/ThisCell> file at initialization.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
To enable programs from each specified cell to run with setuid permission,
|
2005-12-09 14:48:56 +00:00
|
|
|
include the B<-suid> flag. To prohibit programs from running with setuid
|
|
|
|
permission, include the B<-nosuid> flag, or omit both flags.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
The B<fs setcell> command directly alters a cell's setuid status as
|
|
|
|
recorded in kernel memory, so rebooting the machine is unnecessary.
|
|
|
|
However, non-default settings do not persist across reboots of the machine
|
|
|
|
unless the appropriate B<fs setcell> command appears in the machine's AFS
|
|
|
|
initialization file.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
To display a cell's setuid status, issue the B<fs getcellstatus> command.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
=head1 CAUTIONS
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
AFS does not recognize effective UID: if a setuid program accesses AFS
|
|
|
|
files and directories, it does so using the current AFS identity of the
|
|
|
|
AFS user who initialized the program, not of the program's owner. Only
|
|
|
|
the local file system recognizes effective UID.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
Only members of the system:administrators group can turn on the setuid
|
|
|
|
mode bit on an AFS file or directory.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
When the setuid mode bit is turned on, the UNIX C<ls -l> command displays
|
|
|
|
the third user mode bit as an C<s> instead of an C<x>. However, the C<s>
|
|
|
|
does not appear on an AFS file or directory unless setuid permission is
|
|
|
|
enabled for the cell in which the file resides.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 OPTIONS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
=item B<-cell> <I<cell name>>+
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Names each cell for which to set setuid status. Provide the fully
|
|
|
|
qualified domain name, or a shortened form that disambiguates it from the
|
2005-12-09 14:48:56 +00:00
|
|
|
other cells listed in the local F</usr/vice/etc/CellServDB> file.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
=item B<-suid>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Allows programs from each specified cell to run with setuid
|
2005-12-09 14:48:56 +00:00
|
|
|
privilege. Provide it or the B<-nosuid> flag, or omit both flags to
|
|
|
|
disallow programs from running with setuid privilege.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
=item B<-nosuid>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Prevents programs from each specified cell from running with setuid
|
2005-12-09 14:48:56 +00:00
|
|
|
privilege. Provide it or the B<-suid> flag, or omit both flags to disallow
|
|
|
|
programs form running with setuid privilege.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
=item B<-help>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-09 14:48:56 +00:00
|
|
|
Prints the online help for this command. All other valid options are
|
|
|
|
ignored.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head1 EXAMPLES
|
|
|
|
|
|
|
|
The following command enables executable files from the State University
|
|
|
|
cell to run with setuid privilege on the local machine:
|
|
|
|
|
|
|
|
% fs setcell -cell stateu.edu -suid
|
|
|
|
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
|
|
|
|
The issuer must be logged in as the local superuser root.
|
|
|
|
|
|
|
|
=head1 SEE ALSO
|
|
|
|
|
|
|
|
L<fs_getcellstatus(1)>
|
|
|
|
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|