jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-19 07:20:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4f7d192bcb
openafs/doc/man-pages/pod8/bos_setrestricted.pod

99 lines
2.8 KiB
Plaintext
Raw Normal View History

Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
=head1 NAME
bos_setrestricted - place a server in restricted mode
=head1 SYNOPSIS
=for html
<div class="synopsis">
doc: bos setrestricted -mode 0 does make sense Commit 070230ab76e1df338db3f2a7971111ca976a0c1a added documentation of the mode parameter to bos setrestricted, claiming that the value 0 is useless, and commit eee0bf5871944d919951cc8b7b4908ee909c3b62 added documentation of the restrictmode entry in BosConfig, claiming that it can only be set back to 0 with an editor. Both claims are wrong, since bos setrestricted -mode 0 will do exactly that (if it succeeds, which it only can if the server is running in unrestricted mode, which can be achieved by sending it the FPE signal). Fix the man pages accordingly. Change-Id: I07b75f7d0cea2e247fa4f346121de258e35119f5 Reviewed-on: http://gerrit.openafs.org/10885 Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> Reviewed-by: Marc Dionne <marc.c.dionne@gmail.com> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: D Brashear <shadow@your-file-system.com>
2014-03-12 09:47:17 +00:00
B<bos setrestricted> S<<< B<-server> <I<machine name>> >>> S<<< B<-mode> (0 | 1) >>>
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
S<<< [B<-cell> <I<cell name>>] >>> [B<-noauth>] [B<-localauth>] [B<-help>]
=for html
</div>
=head1 DESCRIPTION
fix some typos in bos_setrestricted the real name of the command is: 'bos setrestricted' it is sufficient to name 'bos install' only once Change-Id: Ic68f7cb55466e1c92c34eeda37c0a64a11b7e4d8 Reviewed-on: http://gerrit.openafs.org/8990 Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com> Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil> Reviewed-by: Derrick Brashear <shadow@your-file-system.com>
2013-01-30 19:11:04 +00:00
The B<bos setrestricted> command places the server in restricted mode. This
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
mode increases the security of the bos server by removing access to a
number of bos commands that are only used whilst configuring a system.
When a server is in restricted mode, access to B<bos_exec>, B<bos uninstall>,
fix some typos in bos_setrestricted the real name of the command is: 'bos setrestricted' it is sufficient to name 'bos install' only once Change-Id: Ic68f7cb55466e1c92c34eeda37c0a64a11b7e4d8 Reviewed-on: http://gerrit.openafs.org/8990 Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com> Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil> Reviewed-by: Derrick Brashear <shadow@your-file-system.com>
2013-01-30 19:11:04 +00:00
B<bos install>, B<bos create>, B<bos delete>, B<bos prune>
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
is denied, and the use of B<bos getlog> is limited.
=head1 CAUTIONS
Once a server has been placed in restricted mode, it may not be opened up
again using a remote command. That is, B<bos setrestricted> has no method
doc: bos setrestricted -mode 0 does make sense Commit 070230ab76e1df338db3f2a7971111ca976a0c1a added documentation of the mode parameter to bos setrestricted, claiming that the value 0 is useless, and commit eee0bf5871944d919951cc8b7b4908ee909c3b62 added documentation of the restrictmode entry in BosConfig, claiming that it can only be set back to 0 with an editor. Both claims are wrong, since bos setrestricted -mode 0 will do exactly that (if it succeeds, which it only can if the server is running in unrestricted mode, which can be achieved by sending it the FPE signal). Fix the man pages accordingly. Change-Id: I07b75f7d0cea2e247fa4f346121de258e35119f5 Reviewed-on: http://gerrit.openafs.org/10885 Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> Reviewed-by: Marc Dionne <marc.c.dionne@gmail.com> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: D Brashear <shadow@your-file-system.com>
2014-03-12 09:47:17 +00:00
of placing the server in unrestricted mode. Once a server is restricted,
it can only be opened up again by sending it a SIGFPE, which must be done
as root on the local machine.
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
=head1 OPTIONS
=over 4
=item B<-server> <I<machine name>>
Indicates the server machine to restrict.
doc: bos manpage fixes Add missing documentation for the -mode option. Change-Id: I360dc3d4cc6d7405feb655bbf2a05aee27a41d46 Reviewed-on: http://gerrit.openafs.org/10390 Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com> Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Derrick Brashear <shadow@your-file-system.com>
2013-06-14 21:58:45 +01:00
=item B<-mode> <I<mode>>
Indicates whether to turn restricted mode off or on. Pass a 1 to turn
doc: bos setrestricted -mode 0 does make sense Commit 070230ab76e1df338db3f2a7971111ca976a0c1a added documentation of the mode parameter to bos setrestricted, claiming that the value 0 is useless, and commit eee0bf5871944d919951cc8b7b4908ee909c3b62 added documentation of the restrictmode entry in BosConfig, claiming that it can only be set back to 0 with an editor. Both claims are wrong, since bos setrestricted -mode 0 will do exactly that (if it succeeds, which it only can if the server is running in unrestricted mode, which can be achieved by sending it the FPE signal). Fix the man pages accordingly. Change-Id: I07b75f7d0cea2e247fa4f346121de258e35119f5 Reviewed-on: http://gerrit.openafs.org/10885 Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> Reviewed-by: Marc Dionne <marc.c.dionne@gmail.com> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: D Brashear <shadow@your-file-system.com>
2014-03-12 09:47:17 +00:00
restricted mode on, and pass a 0 to turn restricted mode off. The latter
will only work if the server is already running in unrestricted mode, and
thus won't do anything immediately, but can be used to change the
corresponding entry in L<BosConfig(5)>.
doc: bos manpage fixes Add missing documentation for the -mode option. Change-Id: I360dc3d4cc6d7405feb655bbf2a05aee27a41d46 Reviewed-on: http://gerrit.openafs.org/10390 Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com> Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Derrick Brashear <shadow@your-file-system.com>
2013-06-14 21:58:45 +01:00
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
=item B<-cell> <I<cell name>>
Names the cell in which to run the command. Do not combine this argument
with the B<-localauth> flag. For more details, see L<bos(8)>.
=item B<-noauth>
Assigns the unprivileged identity C<anonymous> to the issuer. Do not
combine this flag with the B<-localauth> flag. For more details, see
L<bos(8)>.
=item B<-localauth>
Constructs a server ticket using a key from the local
F</usr/afs/etc/KeyFile> file. The B<bos> command interpreter presents the
ticket to the BOS Server during mutual authentication. Do not combine this
flag with the B<-cell> or B<-noauth> options. For more details, see
L<bos(8)>.
=item B<-help>
Prints the online help for this command. All other valid options are
ignored.
=back
=head1 PRIVILEGE REQUIRED
The issuer must be listed in the F</usr/afs/etc/UserList> file on the
machine named by the B<-server> argument, or must be logged in as the
local superuser C<root> if the B<-localauth> flag is included.
As noted above, this command cannot be run against servers which are
already in restricted mode.
=head1 SEE ALSO
doc: improve man pages related to bos restricted mode Mention the restrictmode entry and the commands for setting and querying it in the BosConfig man page, and add/fix cross references between the BosConfig, bos, bos_getrestricted and bos_setrestricted ones. Change-Id: I938ef4c43c1a248335f09975c454b36f7570782c Reviewed-on: http://gerrit.openafs.org/10874 Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com> Tested-by: Jeffrey Altman <jaltman@your-file-system.com>
2014-03-07 10:03:36 +00:00
L<BosConfig(5)>,
L<bos(8)>,
L<bos_getrestricted(8)>
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
=head1 COPYRIGHT
spelling/grammar fixes for manpages Several small fixes for spelling and grammar. Change-Id: I5c1cbc933cd683f997b8bb649408d57d84a110f2 Reviewed-on: http://gerrit.openafs.org/3890 Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2011-02-03 20:22:02 +00:00
Copyright 2009 Simon Wilkinson <simon@sxw.org.uk>
Turn on bos restricted code Remove the #ifdef's around the bos restricted mode code. This makes restricted mode available as part of the standard build, but a server will not go into restricted mode unless the relevant command line options are specified, or bos setrestricted is run. Document bos_setrestricted and bos_getrestricted, and the new '-restricted' command line option. Add a note to the man pages of all of the commands whose behaviour is affected by restricted mode. Add 'setr' and 'getr' aliases for setrestart and getrestart so that these documented shortcuts continue to work (otherwise they'd be ambiguous against setrestricted and getrestricted). Note that setre, setres, and setrest will not work once this patch is applied. Change-Id: Ie69d21493ea5f78757f0a3d478de43fdaabd3c31 Reviewed-on: http://gerrit.openafs.org/1028 Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net> Tested-by: Andrew Deason <adeason@sinenomine.net> Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
2009-12-24 13:00:53 +00:00
This documentation is covered by the BSD License as written in the
doc/LICENSE file. This man page was written by Simon Wilkinson for
OpenAFS.
Reference in New Issue Copy Permalink